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ABSTRACT 


Exploratory  research,  needed  to  develop  quantitative  structural  design 
criteria  for  aerospace  vehicles,  has  been  conducted  to  relate  the  probabilistic 
nature  of  design,  operational,  and  environmental  experiences  to  the  structural 
performance  of  aerospace  vehicles.  Volume  I  presents  a  critique  of  present 
and  proposed  approaches  to  structural  design  criteria.  Volume  II  presents  the 
philosophy  and  implementation  of  the  new  procedure.  Volume  III  formulates  two 
computer  programs  for  the  procedure  and  presente  the  user's  instructions  for 
the  programs. 

Volume  II  develops  the  philosophy  of  a  statistically -based,  deterministic 
system.  This  system  forms  the  foundation  of  the  recommended  new  procedure, 
which  is  a  modification  of  the  Present  (Factor  of  Safety)  Structural  Design 
System,  not  a  conpletely  different  approach.  The  concept  that  the  structural 
system  is  expected  to  have  the  capability  to  survive  both  overload  and  under¬ 
strength  situations  is  propounded.  Requirements  for  providing  these  two 
capabilities  are  identified  separately  and  explicitly.  These  requirements  are 
based  on  statistical  considerations,  but  the  resulting  design  conditions  are 
established  as  deterministic  requirements.  This  is  the  key  to  making  the  new 
procedure  practical  and  administrabls.  A  one  page  summary  of  the  procedure  is 
presented  on  page  122.  An  application  of  the  procedure  to  the  F-100  airplane 
demonstrates  how  to  use  the  technique.  Problems  that  may  be  encountered  in 
implementing  the  procedure  are  discussed. 

This  document  is  subject  to  special  export  controls  and  each  transmittal 
to  foreign  nations  or  foreign  governments  may  be  made  only  with  prior 
approval  of  the  Air  Force  Flight  dynamics  Laboratory  (FDTR),  Wright-Pat ter son 
AFB,  Ohio  45433. 
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The  International  System  of  Units  (SI)  was  adopted  by  the  Eleventh 
General  Conference  on  Weights  and  Measures,  Paris,  October,  I960,  in 
Resolution  No.  12,  Reference  (32).  Conversion  factors  for  the  units  used 
herein  are  given  in  the  following  table; 
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6.8947572 
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SECTION  1 


INTRODUCTION 


The  development  of  a  new  procedure  for  defining  quantitative  structural 
design  criteria  by  statistical  methods  is  described  in  this  report.  This 
procedure  is  intended  to  overcome  the  problems  associated  with  other 
structural  design  criteria  procedures.  These  other  systems  were  evaluated 
and  the  problems  discussed  in  Volume  I  of  this  report.  Volume  III  formulates 
and  describes  two  computer  programs  used  in  this  volume  for  conducting 
parametric  studies  of  the  effect  of  various  parameters  on  structural 
reliability. 

In  order  to  develop  a  rational  procedure,  it  is  necessary  to  have  a 
clear  understanding  of  wt.at  the  procedure  is  expected  to  accomplish.  This 
understanding  involves  recognition  that  structural  design  criteria  (SOC)  does 
not  stand  isolated  from  all  considerations  except  those  explicitly  affecting 
the  structural  system.  SDC  is  only  one  part  of  the  structural  design  system 
that  produces  a  new  structural  system.  This  structural  system  is  one  of  many 
subsystems  which  are  part  of  a  vehicle  system.  Many  of  these  other  subsystems 
interact  with  the  structural  system.  These  interactions  constitute  part  of 
the  environment  of  the  structural  system.  The  vehicle  system  becomes  part  of 
an  operational  system  which  provides  another  part  of  the  structural  system 
environment . 

The  basic  philosophy  of  the  new  procedure  i3  presonted  in  Section  II  of 
this  report.  It  is  noted  that  the  making  of  decisions  is  the  key  element  in 
the  procedure.  There  must  be  a  decision  as  to  what  the  structural  system  is 
expected  to  do.  This  must  be  followed  by  a  decision  as  to  whether  the 
structural  system  will  accomplish  what  it  is  intended  to  accomplish.  These 
decisions  become  part  of  a  decision  network  outlined  in  Section  IV  of  this 
volume • 

The  various  decisions  must  be  based  on  information  quantitatively  defiring 
what  it  ie  desired  for  the  state  of  the  structural  system  and  what  the  actual 
state  of  the  systam  is.  This  method  of  presentation  is  based  on  a  concept 
presented  by  Draper.  Application  of  Draper's  concept  to  the  definition  of  a 
structural  design  system  is  described  at.  length  in  Volume  1. 

This  new  procedure  represents  a  modification  of  the  Present  (Factor  of 
Safety)  Structural  Design  System  which  was  described  and  evaluated  in 
Volume  I.  The  procedure  is  a  statistically-based,  deterministic  system  ir. 
contrast  to  the  Purely  Statistical  Structural  Reliability  Systems  described 
and  evaluated  in  Volume  I.  The  design  conditions  in  the  new  system  ars  defined 
with  the  intent  that  they  satisfy  specified  statistical  considerations. 

However,  once  the  decision  is  made,  the  design  conditions  become  discrete 
conditions  that  define  the  structural  requirements  explicitly.  These  discrete 
conditions  also  dofine  the  interfaces  with  other  systems.  The  areas  of 
responsibility  and  nonresponsibility  for  both  the  structural  and  nonotructur&l 
systems  can  be  established  unequivocally. 


The  choloe  of  these  design  conditions  ie  based  on  a  prediction  of  what 
ie  expected  to  happen  in  the  future  from  knowledge  of  what  has  happened  in 
similar  circumstances  in  the  past  together  with  an  analysis  of  expected 
modification  of  these  past  statistics.  Where  aufficient  statistics  are  not 
available,  engineering  judgement  ie  accepted  as  a  form  of  prediction.  The 
new  procedure  recognizee  that  the  future  results  can  be  influenced  or  even 
controlled  so  that  the  statistics  of  actual  future  operations  of  the  new 
vehicle  can  be  forced  to  be  consistent  with  the  initial  predictions  in  most 
cases. 

Whether  the  structural  environment  can  be  controlled  or  whether  it  is 
noncontrollable,  the  results  of  the  vahiola  operations  in  the  environment  can 
be  monitored.  This  information  becomes  part  of  the  structural  design  system 
and  is  used  to  decide  whether  the  operations  and  structural  reliability 
attained  are  satisfactory.  If  not,  a  decision  can  be  made  either  to  change 
the  actual  operations  to  match  the  specified  capability  of  the  structural 
system  or  to  change  the  specified  structural  capability  to  match  the  actual 
operations. 

Section  II  develops  the  philosophy  and  rationale  behind  the  new  procedure. 
Section  III  presents  the  technical  approach  of  the  procedure.  Section  IV 
contains  flow  diagrams  to  illustrate  the  interaction  of  the  various  functions 
involved.  Section  V  contains  a  synopsis  of  the  procedure  for  quick  assimila¬ 
tion  of  the  salient  features  of  the  new  approach.  Application  of  the  new 
procedure  is  demonstrated  on  the  F-100  airplane  in  Section  VI  by  comparing 
the  output  of  the  computer  program  with  actual  service  records.  Some  of  the 
advantages  and  some  of  the  potential  problems  that  may  bo  encountered  in 
implementing  the  new  procedure  are  discussed  in  Section  VII.  Conclusions 
and  recommendations  are  presented  in  Section  VIII. 

It  is  possible  that  the  reader  may  desire  an  overview  of  the  new 
procedure  prior  to  starting  to  follow  the  development  in  Section  II  of  the 
philosophy  behind  the  new  procedure.  If  so,  it  may  bo  advantageous  to  read 
the  brief  step-by-step  outline  of  the  procedure  in  Section  III  or  the  synopsis 
in  Section  V.  A  one-page  summary  is  presented  on  page  122. 
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SECTION  II 


THE  PHILOSOPHY  OF  STRUCTURAL-  DESIGN  CRITERIA 


2.1  GENERAL 

The  purpose  of  the  study,  reported  in  this  volume,  is  to  accomplish  the 
research  needed  to  develop  quantitative  structural  design  criteria  for  aero¬ 
space  vehicles.  The  criteria  are  expected  to  rtlate  the  probabilistic  nature 
of  design,  operational,  and  environmental  experiences  to  the  structural 
performance. 

In  order  to  formulate  a  new  procedure  for  structural  design  criteria 
(SDC),  it  is  necessary  to  have  a  clear  understanding  of  what  the  procedure 
is  expected  to  accomplish.  This  section  of  the  report  will  be  devoted  to 
that  task. 

The  first  stop  in  the  process  of  defining  the  purpose  of  SDC  is  to 
understand  the  relationship  of  SDC  to  the  total  structural  design  system. 

This  question  was  taken  up  at  length  in  Volume  I  of  this  report,  but  some  of 
it  bears  repeating  in  order  to  establish  the  framework  for  the  formulation  of 
the  new  procedure.  A  structural  design  system  is  defined  very  broadly  in 
this  report.  It  includes  far  more  than  Just  the  structural  design  criteria. 
It  includes  the  state  of  the  art  affecting  strength  and  loads  analysis.  It 
includes  the  drafting  room  procedures  that  affect  the  checking  of  the 
structural  drawings.  It  includes  the  government  material  specifications  and 
it  also  includes  the  know-how  of  materials  producers.  It  includes  fabrica¬ 
tion  techniques  in  the  shop  and  it  includes  maintenance  techniques  in  the 
field.  It  includes  the  pilot's  flight  handbook  and  it  includes  everything 
that  has  an  interface  with  the  structural  system  (commonly  called  the 
airframe  or  the  hardware),  and  everything  that  has  a  bearing  on  whether  the 
structure  survives  in  the  performance  of  its  stated  mission. 

It  is  recognized  that  such  a  broad  definition  of  the  structural  design 
system  is  not  universally  accepted.  It  is  acknowledged  that  there  are 
Jurisdictional  problems  in  any  organization  that  inhibit  control  by  the 
structures  organization  of  all  things  that  affect  the  structural  system. 
Nevertheless,  it  is  necessary  in  any  evaluation  of  a  structural  design  system 
to  recognize  the  existence  of  these  problems.  Che  measure  of  the  effective¬ 
ness  of  a  system  is  how  well  it  copes  with  these  interface  problems.  There¬ 
fore,  the  approach  developed  in  this  report  will  not  be  limited  by  any 
preconceived  ideas  limiting  the  prescribed  field  of  responsibility  for  the 
structures  organization. 

The  philosophy  to  be  followed  in  the  development  of  the  proposed  new 
structural  design  criteria  ie  described  in  several  steps.  First,  the 
objectives  to  be  accomplished  by  the  SDC  are  defined.  This  corresponds  to 
establishing  the  Desired  State  shown  on  Figure  1.  Then,  procedures  to 
ic^jlemerit  these  objectives  will  be  described.  Finally,  a  discussion  of  what 
constitutes  proof  of  compliance  with  tho  objective*  will  be  presented.  This 
corresponds  to  a  determination  of  the  Actual  State  as  shown  on  Figure  1 . 


EFFECTOR 


Although  the  basic  philosophy  aat  forth  in  this  report  is  universal  in 
its  application,  it  is  convenient  to  develop  and  discuss  the  philosophy  first 
in  terms  of  the  simpler  time-independent  (static)  strength  situation.  Then, 
it  is  extended  to  include  the  time-dependent  situations  such  as  fatigue,  hot 
structure  and  erosion. 

2.2  FUNCTIONS  OF  A  STRUCTURAL  DESIGN  SYSTEM 

A  generalized  functional  diagram  of  a  structural  design  system  was 
presented  in  Volume  I  of  this  report.  This  diagram  is  reproduced  as  Figure  1 
in  this  volume. 

The  fundamental  purpose  of  any  structural  design  system  is  the  creation 
of  an  operational  structural  system  that  will  enable  the  vehicle  to  satis¬ 
factorily  perform  its  mission.  The  desired  structure  is  not  wished  into 
existence.  It  is  the  result  of  many  management  decisions  that  trigger 
actions  in  many  processes  leading  to  the  final  product.  The  making  of 
decisions  is  the  key  element  in  the  procedure. 

It  should  be  noted  from  Figure  1  that  Structural  Design  Criteria  (3DC) 
is  only  °ne  of  the  many  functions  that  compose  the  structural  design  system. 
This  serves  to  emphasize  the  fact  that  SDC,  in  and  of  itself,  cannot 
guarantee  a  high  level  of  structural  integrity  or  structural  reliability  in 
any  etructural  system.  Many  other  considerations  enter  into  the  picture.  As 
noted  above,  the  purpose  of  a  structural  design  system  is  the  creation  of  an 
operational  structural  system  that  will  enable  the  vehicle  to  satisfactorily 
porforr  its  mission.  This  definition  requires  the  specification  of  a  number 
of  functions  before  it  is  meaningful.  It  indicates  that  the  vehicle  has  a 
mission  to  perform  which,  in  turn,  indicates  that  the  structural  system,  as 
a  vehicle  subsystem,  has  a  mission  to  perform.  In  order  to  determine  if 
the  structural  system  is  performing  its  mission  satisfactorily,  the  mission 
must  be  carefully  defined  and  a  quantitative  definition  of  what  constitutes 
satisfactory  performance  must  be  established.  However,  the  simple  act  of 
defining  the  requirements  for  the  structural  system  is  not  sufficient.  As 
Coutinho^  says,  "There  are  individuals  who  believe  that  the  specification  is 
the  end  product;  they  are  not  concerned  with  hardware....  There  was  no 
appreciation  either  of  what  had  to  be  done  in  the  design  and  development 
cycle  to  obtain  this  level  of  reliability,  or  what  reasonable  level  of 
reliability  was  needed  to  accomplish  a  mi33ion." 

The  making  of  decisions  at  various  times  in  the  design  procedure  is  the 
key  element.  The  standard  for  Judging  the  value  of  any  structural  design 
system  must  be  the  consideration  of  how  effectively  decisions  are  made  and 
implemented.  '  In  Volume  I  the  decisions  to  be  made  are  grouped  in  three 
categories- 

1.  How  effectively  does  the  structural  design  system  define  the 
Desired  Stats  of  the  structural  system? 

2.  Hew  accurately  can  the  Actual  State  of  the  etructural.  system 
be  determined? 
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3.  How  early  in  the  design  and  deployment  cycle  of  the  operational 
system  will  any  discrepancies  between  the  Desired  State  and 
Actual  Stats  be  disclosed? 

Although  the  three  questions  above  are  phrased  in  the  language  used  by 
Draper-*-  (partially  reproduced  in  Volume  I),  the  questions  are  simply  common 
sense.  If  a  quantitative  SDC  is  to  be  developed,  one  must  decide  what  the 
structure  is  expected  to  do.  This  includes  what  the  structure  is  not  expected 
to  do  in  terms  of  tolerating  and  surviving  malfunctions,  errors,  and  extreme 
or  abnormal  operational  situations  imposed  on  the  structural  system  by  non- 
structural  systems.  The  decision  on  what  the  structural  system  is  expected 
to  do  must  be  followed  by  a  decision  as  to  whether  the  structural  system 
will  accoiqplish  what  it  is  intended  to  accomplish.  To  make  this  decision  it 
must  be  possible  to  measure  or  determine  some  function  numerically  in  order 
to  confers  it  with  the  desired  value.  If  the  number  is  equal  to  or  better 
than  the  desired  value  of  the  parameter,  the  structural  system  is  acceptable. 

If  not,  the  structural  system  is  unacceptable  and  changes  must  be  made. 

Finally,  the  decision  to  accept  or  change  the  structural  system  must  be  made 
as  early  as  possible  in  the  design  and  deployment  cycle.  It  is  always  more 
economical  to  change  a  prototype  structure  than  to  make  changes  during  the 
production  phase.  The  most  unacceptable  changes  that  can  occur  are  those 
that  occur  after  the  vehicle  has  bean  accepted  for  operational  usage.  Thus, 
the  concern  indicated  by  the  last  of  the  three  questions  posed  above. 

Volume  I  of  this  report  has  evaluated  the  Present  (Factor  of  Safety) 
Structural  Design  System,  a  Purely  Statistical  Structural  Reliability  System, 
and  the  individual  approaches  recommended  by  14  different  authors.  It  is 
shown  that  all  of  these  procedures  are  deficient  either  in  defining  the 
Desired  State  of  the  structural  system  or  in  determining  the  Actual  State. 

The  procedure  developed  during  this  study  is  intended  to  remedy  the 
deficiencies  noted  in  Volume  I. 

Volume  I  concludes  that  "The  fundamental  problem  area  in  the  Present  System 
resides  in  the  fact  that  there  is  no  clearly  identifiable,  quantitative  objective 
that  the  Present  System  is  expected  to  satisfy."  A  factor  of  safety  (F3),  such 
as  the  commonly  used  1.5  value,  does  not  provide  any  consistent  level  of 
performance  for  the  structural  system.  Due  to  non-linearities  and  other 
considerations,  one  vehicle  with  a  1.5  factor  of  safety  might  be  able  to 
attain  1.75  times  the  limit  operational  condition  and  another  vohicle  with 
the  same  factor  of  safety  might  attain  only  1.25  times  the  limit  operational 
condition.  Such  a  situation  is  discussed  in  Reference  3*  Even  if  a  given 
FS  results  in  the  same  operational  capability  relative  to  the  specified 
limit  conditions,  the  frequency  with  which  operations  exceed  the  available 
structural  capability  may  vary  grossly  from  one  vehicle  system  to  another. 

The  difference  in  failure  rates  associated  with  these  possible  situations 
might  be  orders  of  magnitude.  It  is  difficult  to  accept  the  rationality  of 
a  system  that  would  permit  such  divergent  performances  for  vehicles  expected 
to  perform  the  same  mission. 

Moat  of  the  authors  of  the  papers  evaluated  in  Volume  I  of  this  report  have 
adopted  a  system  where  a  structural  reliability  number  would  be  established  as  the 
requirement.  The  evaluation  in  Sections  Ill  and  TV  of  Volume  I  has  made 
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clear  that  ouc.h  systems  ara  not  practical  for  tho  design  of  aerospace 
vehicles.  The  principal  deterrent  to  the  adoption  of  a  Purely  Statistical 
Structural  Reliability  System  is  the  fact  that  there  is  no  procedure  for 
accurately  determining  the  actual  structural  reliability  of  a  particular 
structural  design.  As  a  result  there  is  no  proof  of  compliance  technique 
that  would  be  satisfactory  for  demonstration  that  a  contractual  requirement 
has  been  fulfilled. 

2.3  TIME-INDEPENDENT  (STATIC)  STRENGTH  SITUATIONS 

Th8  approach  suggested  in  this  report  is  intended  to  overcome  the 
problems  noted  in  Section  2.2.  The  logic  of  a  very  rudimentary  system  is 
developed  in  this  section  and  then  expanded  step-by-step  until  it  includes 
all  of  the  elements  of  the  real  problem.  This  initial  development  of  the 
approach  has  most  of  the  attributes  of  the  final  system  but  the  principles 
involved  should  be  easier  to  comprehend  in  this  simpler  form.  The  complete 
approach  is  considered  to  be  a  modification  of  the  Present  (Factor  of  Safety) 
Structural  Design  System.  The  modifications  will  not  require  a  radical 
departure  from  present  standards  for  designing  the  structural  system  of  an 
aerospace  vehicle.  However,  some  detail  changes  will  be  necessary  to 
implement  the  new  procedure.  These  changes  will  be  noted  as  the  development 
of  the  procedure  unfolds. 

The  first  simplification  used  in  the  presentation  of  the  new  procedure 
is  to  consider  only  situations  where  the  strength  of  the  structural  system 
does  not  vary  significantly  during  the  life  of  the  vehicle.  This  is  the 
basis  on  which  most  of  the  present  SDC  have  evolved.  The  functional  model 
representing  this  type  of  structural  system  is  obviously  much  sinpler  than 
the  model  for  a  system  with  a  time-dependent  strength.  However,  the  basic 
principles  involved  in  the  development  of  the  philosophy  are  not  affected  by 
the  question  of  the  time-dependency  of  the  strength. 

a.  Rudimentary  System 
(1)  Criteria 

The  philosophy  on  which  the  new  procedure  is  based  starts  with  recogni¬ 
tion  of  tho  underlying  desire  to  have  no  failures,  ever,  in  the  structural 
system.  It  is  a  verity  which  many  authors  have  pointed  out  that  a  "no-failura- 
everH  requirement  would  result  in  an  infinitely  strong  and  infinitely  heavy 
structure.  Something  less  must  be  accepted.  This  could  be  called  a  "no- 
fallure-unless"  requirement.  It  simply  is  not  feasible  to  require  that  a 
structural  system  support  any  conceivable  load  that  might  be  inposed  on  it. 

Nor  is  it  feasible  to  require  that  a  structural  system  retain  sufficient 
strength  to  survive  with  the  understrength  resulting  from  any  conceivable 
error  in  design,  fabrication  or  maintenance. 

Following  this  line  of  reasoning,  the  first  qualification  to  the  "no- 
fallure-ever"  requirement  is  that  no  failures  will  be  tolerated  unless  the 
vehicle  Is  operated  outside  the  defined  and  expected  boundaries  of  the 
prescribed  mission  by  a  significant  increment.  Cfcvlously,  this  requires  a 
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careful  definition  of  the  mission  and  of  these  boundaries.  It  also  requires 
a  definition  of  what  consitutes  a  significant  increment  beyond  these 
boundaries.  It  should  be  noted  that  structural  failures  are  never  "acceptable" 
but  may  be  tolerated  as  an  unavoidable  result  of  obtaining  a  minimum  weight 
and,  thus,  a  useful  vehicle. 

This  suggests  that  the  Desired  State  for  the  structural  system  could  be 
qualitatively  defined  as  follows: 

Ho  structural  failure  will  be  tolerated  while  the 
vehicle  is  performing  normally  but  failures  during 
abnormal  operations  will  be  tolerated. 

A  more  precise  definition  of  normal  and  abnormal  operations  will  be  given 
later.  Associated  with  this  definition  of  when  structural  failure  will  or 
will  not  be  tolerated  should  be  a  determination  of  who  will  be  responsible  in 
case  a  failure  does  occur.  If  responsibility  can  be  assigned  after  a  failure 
occurs,  certainly  responsibility  for  preventing  failure  can  be  allocated  before  a 
failure  ever  occurs.  It  is  considered  that  this  explicit  assignment  of 
responsibility  is  a  vital  element  in  the  new  procedure.  It  is  something 
that  is  missing  from  the  present  procedures  and  from  those  procedures 
evaluated  in  Volume  I. 

As  a  specific  eocan5>le  of  the  meaning  of  this  principle  of  the  allocation 
of  responsibility  for  the  prevention  of  structural  failures,  the  definition  of 
the  Desired  State  given  above  can  be  expanded  to  include  a  definition  of 
responsibility.  The  structural  system  and  those  concerned  with  its  design, 
fabrication  and  maintenance  are  responsible  for  the  prevention  of  structural 
failures  while  the  vehicle  is  operating  normally.  Ch  the  other  hand,  they 
are  not  responsible  for  failures  that  occur  while  the  vehicle  is  operating 
abnormally.  Since  structural  failures  will  be  tolerated  if  they  occur  in 
the  range  of  operations  considered  to  be  abnormal,  it  must  be  the  respon¬ 
sibility  of  the  non-structural  systems  to  prevent  failures  in  this  range  by 
avoiding  the  abnormal  situation. 

To  develop  a  definition  of  the  normal  range  of  operations  where  the 
structure  is  expected  to  never  fail  and  the  abnormal  range  of  operations 
where  structural  failure  will  be  tolerated,  the  capability  to  distinguish 
between  a  normal  and  an  abnormal  operation  must  be  developed.  It  does  not 
appear  to  be  reasonable  to  consider  that  operations  at  some  particular  level 
of  severity  are  normal  whereas  operations  at  an  infinitesimally  more  severe 
condition  are  abnormal.  However,  it  does  appear  reasonable  to  designate 
one  level  of  operation  as  normal  and  another  at  a  discretely  higher  level  as 
abnormal. 

If  the  structural  system  had  characteristics,  such  that  it  "never" 
failed  at  the  operational  level  designated  normal,  but  "always"  failed 
exactly  at  the  level  designated  abnormal,  the  system  would  meet  the  defini¬ 
tion  for  the  Desired  State  of  the  structural  system  given  above.  This 
hypothetical  system  has  some  interesting  attributes.  If  the  structural 
system  "always"  failed  at  the  level  designated  as  abnormal,  it  would  "never" 
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fail  at  the  level  designated  ae  normal.  This  would  fulfill  the  responsibility 
of  the  structural  system  to  prevent  failures  under  normal  operational  condi¬ 
tions.  Failures  would  occur  whenever  the  level  designated  as  abnormal  was 
exceeded.  However,  responsibility  for  preventing  such  failures  is  outside 
the  purview  of  the  structural  system.  Failures  would  occur  only  if  the 
abnormal  operation  is  encountered.  Responsibility  for  prevention  of  such 
abnormal  operations  and  thus  prevention  of  structural  failures  as  a  result  of 
such  operations  rests  with  those  responsible  for  the  vehicle  operation. 

This  description  of  the  proposed  structural  design  system  is  essentially 
a  description  of  the  Present  System  that  has  evolved  in  the  design  of  aero¬ 
space  vehicles  during  the  years  past.  The  normal  operating  conditions  have 
been  called  limit  conditions.  These  limit  conditions  have  been  conveyed  to 
operating  personnel  by  handbooks  describing  operational  limitations  for  the 
vehicle,  by  placards  and  by  other  means.  Operations  up  to  the  limit  conditions 
are  permissive  and,  thus,  must  be  considered  normal.  Any  structural  failure 
at  limit  condition  or  less  is  not  considered  tolerable  and  structures  that 
fail  in  such  circumstances  are  almost  automatically  strengthened.  Operations 
beyond  limit  are  not  approved  so  any  substantial  violation  of  the  operational 
limitations  oust  be  considered  an  abnormal  operation.  Most  failures  of  past 
structural  systems,  aside  from  those  caused  by  correctable  errors  in  the 
structure,  have  come  from  operations  well  beyond  limit  conditions.  Such 
failures  have  to  be  the  responsibility  of  the  vehicle  user  and  not  the 
responsibility  of  the  structural  system.  As  long  as  such  abnormal  usage  does 
not  occur  more  often  than  is  considered  reasonable  for  the  class  of  vehicle 
in  question,  the  structural  system  is  considered  to  be  satisfactory. 

This  willingness  to  tolerate  the  relatively  rare,  infrequent  structural 
failures  that  are  the  result  of  operating  the  vehicle  abnormally— well  beyond 
the  limits  of  the  prescribed  normal  operation-represents  a  qualification  of 
the  desire  for  a  no-failure-ever  situation.  On  this  basis,  the  Desired  State 
could  be  redefined  as: 

No  structural  failure  will  be  tolerated  unless 
the  failure  is  caused  by  an  abnormal  operation 
of  the  vehicle  and  provided  that  the  abnormal 
operation  occurs  infrequently  at  a  rate  that  is 
compatible  with  the  mission  of  the  vehicle. 

At  this  stage  in  the  unfolding  of  the  philosophy  guiding  the  development 
of  the  proposed  new  procedure,  the  model  of  the  structural  design  system 
qualitatively  has  all  the  elements  of  a  realistic,  practical  system.  However, 
further  qualifications  will  be  added  as  the  development  proceeds.  It  will 
clarify  this  future  development  if  the  significance  of  the  development  to 
this  point  is  restated.  Two  operational  conditions  are  defined  —  a  normal 
and  an  abnormal  condition.  The  structure  is  expected  always  to  survive  the 
normal  condition.  Failure  at  the  abnormal  condition  will  be  tolerated.  The 
failure  rate  of  the  vehicle  will  correspond  to  the  frequency  of  attaining  the 
abnormal  condition.  The  probability  of  structural  failure  will  be  equal  to 
the  probability  of  exceeding  the  designated  abnormal  condition.  If  a  parti¬ 
cular  value  of  structural  reliability  is  designated  as  the  nrlnlmim  acceptable, 
the  complement  of  this  structural  reliability  value  represents  the  maximum 
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probability  of  failure  that  will  be  tolerated.  In  turn,  this  means  that  the 
probability  of  attaining  the  abnormal  condition  where  the  structure  is 
expected  to  fail  mist  be  no  more  than  the  complement  of  the  desired  structural 
reliability  value.  Then,  it  follows  that,  if  the  operational  condition  that 
is  designated  as  abnormal  is  chosen  initially  so  that  its  probability  of 
exceedance  is  equal  to  the  complement  of  the  desired  structural  reliability 
and  if  the  structure  is  designed  so  it  will  always  fail  at  or  above  this 
condition  designated  as  abnormal,  the  desired  structural  reliability  will  be 
attained  automatically. 

(2)  Responsibility  and  Administrability 

The  responsibility  for  implementing  the  requirement  just  stated  can  be 
divided  into  two  separate,  identifiable  requirements.  One  would  be  the 
responsibility  of  the  structural  system  and  the  other  would  be  the  respon¬ 
sibility  of  the  operational,  or  nonetructural,  system.  In  effect,  this 
procedure  decoupler  the  two  systems  and  permits  the  requirements  for  each  to 
be  specified  separately.  A  pair  of  numbers  representing  the  definition  of 
the  normal  and  abnormal  condition  would  be  common  to  the  requirements  for 
each  system.  Once  these  numbers  were  established,  they  would  not  be 
dependent  on  the  procedure  by  which  they  were  established.  They  would  stand 
by  themselves  with  the  effect  of  a  specification  requirement. 

The  structural  system  would  have  the  obligation  to  fulfill  two  require¬ 
ments.  Oie  wouM  be  to  provide  the  operational  vehicle  with  a  structural 
system  that  would  always  fail  exactly  at  the  operational  condition  designated 
as  abnormal.  (Remenber  that  this  discussion  is  still  for  a  hypothetical 
design,  much  simplified  from  the  true  situation.)  The  second  structural 
requirement  would  be  to  never  fail  at  the  condition  designated  as  normal. 

This  second  requirement  is  mat  automatically  if  the  first  requirement  is  met. 
So  the  structural  requirement  at  this  point  reduces  to  a  requirement  to 
survive  the  '"abnormal"  condition.  It  is  pertinent  to  note  that  this  require¬ 
ment  is  very  similar  to  but  not  identical  with  the  requirement  in  the  Present 
(Factor  of  Safety)  Structural  Dosign  System.  In  the  Present  System  the 
structure  is  required  to  survive  ultimate  loads,  defined  as  limit  loads 
multiplied  by  the  factor  of  safety.  In  the  new  procedure  the  structure  is 
required  to  survive  the  operational  condition  designated  as  abnormal.  This 
means  that  the  structure  must  survive  the  loads  associated  with  the  abnormal 
condition.  So  both  procedures  require  that  the  structure  survive  a  single, 
discrete  set  of  loads,  although  the  loads  may  be  different  in  the  two  systems. 

Such  a  requirement  is  an  administrable  requirement.  If  a  contract  is 
written  on  the  basis  of  this  procedure,  the  requirements  can  bo  defined 
easily.  The  contractor  must  provide  a  structural  system  capable  of  surviving 
the  condition  designated  abnormal.  This  condition  is  a  discrete  condition, 
identifiable  by  a  number  (a  set  of  numbers).  If  the  structural  system  fails 
at  less  than  this  specified  condition,  the  contractor  has  not  fulfilled  his 
obligation.  On  the  other  hand,  the  contractor  has  no  obligation  to  provide 
any  more  structural  capability  than  the  absolute  minimum  necessary  to 
survive  the  specified  condition.  Thus,  the  contractor's  obligations  are 
epeclfic  but  limited  which  is  the  basis  for  an  administrable  requirement. 
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The  decoupling  of  the  structural  and  operational  requirements  imposes 
some  obligations  on  the  operational  system  and  the  vehicle  user.  The 
definition  of  the  two  operational  conditions,  normal  and  abnormal,  delineates 
these  obligations  of  the  vehicle  user.  The  norna.1  condition  is  by  definition 
just  that.  The  user  should  be  free  to  operate  up  to  this  condition  since  the 
structural  system  has  the  absolute  responsibility  for  preventing  structural 
failures  in  this  operational  range.  Beyond  this  specified  normal  condition, 
operations  are  not  considered  to  be  necessary  to  the  performance  of  the 
vehicle  mission.  It  is  recognized  that  occasional  operations  beyond  tr.e 
condition  designated  as  normal  may  occur.  However,  if  any  operation  is  sc 
far  beyond  the  normal  condition  that  the  condition  designated  abnormal  is 
exceeded,  the  structural  system  may  fail.  The  responsibility  for  this 
operation  and  the  subsequent  failure  must  be  accepted  by  the  vehicle  user. 

As  with  the  requirements  for  the  structural  system,  tne  requirements  for 
the  operational  system  are  similar  to  but  not  identical  with  those  in  the 
Present  (Factor  of  Safety)  System.  The  Present  System  establishes  a  limit 
condition  that  is  comparable  to  the  condition  designated  normal  in  this 
dicussion.  It  is  a  condition  representing  the  upper  limit  of  the  permissible 
operational  rang®  in  both  procedures  and  one  that  is  high  enough  30  that  all 
normal  operations  required  by  the  mission  can  be  performed  without  exceeding 
the  specified  condition.  In  this  respect  the  two  procedures  are  identical. 
There  is  no  comparable  condition  in  the  Present  System  to  the  condition 
designated  as  abnormal  in  the  proposed  system.  However,  the  actions  of  the 
authorities  in  past  situations  where  the  operational  limitations  have  been 
grossly  exceeded  have  been  an  implicit  recognition  that  such  operations  are 
abnormal.  There  has  been  no  explicit  level  where  such  a  determination  is  made 
in  advance.  Nevertheless,  it,  is  inconceivable  that,  in  any  accident  where 
the  aircraft  was  known  to  exceed  the  operational  limitation  by  40  or  50 
percent,  the  cause  of  failure  would  not  be  attributed  to  the  user.  The 
structural  system  almost  certainly  would  be  considered  adequate  in  such  a 
situation.  The  specification  in  advance  of  the  operational  level  at  which 
the  structural  system  has  no  responsibility  for  survival  and  where  the  user 
is  considered  to  have  grossly  overloaded  the  vehicle  does  not  really  charge 
what  has  always  been  recognized  after  the  fact.  Therefore,  the  concept  is 
not  as  radical  a  departure  from  past  practice  as  it  might  seem  to  be. 

To  summarize,  the  structural  system  is  expected  to  always  survive  the 
normal  condition.  If  it  doesn't, sole  responsibility  for  the  failure  rests 
with  the  structural  system  since  operations  to  this  level  are  permissible. 

The  structure  is  not  expected  to  survive  beyond  the  designated  abnormal 
condition.  If  a  failure  does  occur  due  to  vehicle  operation  in  this  region, 
sole  responsibility  for  the  failure  rests  with  the  operating  system. 

With  soma  additional  definition  of  the  exact  meaning  of  some  of  the 
words  used  to  describe  the  proposed  procedure  and  with  some  additional  minor 
qualifications  on  some  of  the  requirements,  the  structural  design  system 
Just  described  can  serve  as  a  rational,  practical  procedure  for  deciding  what 
is  required  of  tho  structural  system  and  for  administering  compliance  with 
the  requirement. 
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(3)  Criteria  Terminology 

The  first  term  that  must  be  defined  more  precisely  is  an 
operational  condition.  Generally,  an  operational  condition  is  some  parameter 
or  combination  of  parameters  that  represents  the  state  of  the  vehicle  as  a 
whole.  An  operational  condition  should  be  something  physically  meaningful 
to  the  vehicle  user  and  generally  controllable  by  the  user.  It  should 
represent  a  definable  Interface  between  the  engineer  or  vehicle  designer  and 
the  vehicle  user.  Such  functions  as  load  fact  or,  weight  and  velocity  are 
certainly  operational  conditions.  So  also  are  control  surface  position  and 
vehicle  attitude.  Typically,  in  aircraft  practice  they  are  functions  the 
pilot  can  sense  qualitatively  even  if  instrumentation  is  needed  to  determine 
the  function  quantitatively. 

Ordinarily,  functions  that  are  local  to  the  structural  system,  such  as 
wing  root  banding  moment  or  the  stress  at  the  comer  of  a  fuselage  window, 
are  not  operational  conditions.  However,  in  certain  instances,  parameters 
of  this  type  can  be  transformed  into  an  operational  condition  by  providing 
the  pilot  with  instrumentation  so  he  can  monitor  the  value  of  the  parameter 
at  all  times. 

User-controlled  conditions  define  most  of  the  environment  to  which  the 
structural  system  is  exposed.  However,  there  are  some  conditions  imposed  on 
the  structural,  system  by  other  vehicle  subsystems.  For  instance,  the 
pressure  in  a  tank  may  be  controlled  routinely  by  an  automatic  regulating 
system  with  additional  regulation  against  overloads  provided  by  a  pressure 
relief  valve.  The  pressures  as  controlled  by  the  regulating  subsystem  can  be 
considered  as  operational  conditions  for  the  structural  system.  In  the  same 
vain,  the  mass  and  velocity  of  meteoroids  impacting  on  a  space  vehicle  are 
considered  as  operational  conditions,  even  though  they  are  not  controllable 
by  the  user  or  by  a  non- structural  subsystem.  From  here  on  in  this  paper, 
the  term  operational  condition  will  include  any  environment  or  input  imposed 
on  the  structural  system  by  a  non- structural  system. 

In  establishing  a  requirement  for  the  structural  system  to  survive  a 
particular  operational  condition,  it  i3  understood  that  failure  occurs  whan 
the  local  load  on  the  structure  exceeds  the  local  strength.  The  transfer 
function  that  transforms  an  external  vehicle  condition  into  an  internal 
vehicle  load  may  involve  personnel  from  many  disciplines,  such  as  dynamicists, 
aerodynamicista  and  weights  engineers.  These  are  all  included  whon  speaking 
of  the  structural  system.  The  basic  interface  is  considered  to  be  between 
the  vehicle  user  and  the  vehicle  designers. 

ins  term  load  is  interpreted  very  broadly  in  this  discussion.  It 
includes  those  functions  that  are  conventionally  thought  of  as  loads,  such 
as  sh >.•)*,  bending  moment  and  torque.  It  also  includes  local  temperatures, 
vibrat.ion  amplitudes  and  corrosive  influences  where  they  affect  the  failure 
potential  of  the  structural  system. 

Another  usage  that  needs  defining  is  the  concept  of  error.  In  the 
context  of  this  paper,  an  error  is  anything  where  the  final  result  is  not  as 
initially  predicted.  The  reason  for  the  discrepancy  and  the  blame,  if  any. 
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are  immaterial.  An  arithmetical  blunder  such  as  a  decimal  point  error  or 
traneposing  nucters  is  leas  defensible  but  h&u  the  same  result  as  a  dis¬ 
crepancy  due  to  ignorance.  The  ignorance  itself  may  be  that  of  an  individual 
who  lacks  some  vital  knowledge  even  though  other  knowledgeable  individuals 
possess  the  requisite  knowledge.  Or  the  ignorance  may  represent  the  current 
state  of  the  art  with  no  one  knowing  the  correct  solution  to  some  problem. 

The  single  term  "error"  covers  all  these  considerations. 

One  final  definition  is  needed  in  the  discussion  and  development  of  a 
quantitative  structural  design  criteria.  This  is  the  name  of  the  operational 
conditions  heretofore  designated  as  normal  and  abnormal.  The  upper  limit  of 
the  normal  opera.  nai  conditions  has  been  considered  to  be  a  limit,  condition 
for  many  years,  a  limit  condition  may  actually  represent  a  combination  of 
two  or  more  parameters  such  as  aircraft  load  factor  and  speed.  Wave  height, 
wave  slope,  wind  velocity,  and  vertical  intact  velocity  in  combination  might 
define  a  limit  condition  for  the  water  landing  of  a  space  capsule.  This  meaning 
of  a  limit  condition  is  consistent  with  the  meaning  currently  attributed  to  the 
limit  condition  in  the  Present  (Factor  of  Safety)  Structural  Design  System. 

The  condition  previously  described  as  an  abnormal  operating  condition 
has  a  new  meaning.  This  condition  corresponds  to  what  some^  have  called  an 
ultimate  condition  in  the  past..  The  term  ultimate  condition  could  be  adopted 
in  this  discussion  but  experience  has  suggested  a  different  name  would  be 
desirable.  No  matter  how  carefully  it  is  explained  that  the  loads  for  the 
ultimate  condition  do  not  represent  exactly  the  same  thing  as  the  ultimate 
loads  in  the  Present  (Factor  of  Safety)  Structural  Design  System,  there  always 
seems  to  be  some  confusion  on  this  ooint.  For  this  reason  it  appears 
desirable  to  adopt  a  new  term  for  the  abnormal  operational  condition  that 
defines  the  condition  where  there  is  no  further  responsibility  for  structural 
survival.  It  is  suggested  that  the  term  "omega  condition"  would  be  a  useful 
term  here.  It  would  emphasize  that  the  condition  is  separate  and  distinct 
from  the  limit  condition,  and  it  may  be  significantly  different  from  the 
condition  associated  with  the  ultimate  loads  of  the  Present  Syetem.  If 
desired,  the  reader  can  substitute  "ultimate  condition"  for  "omega  condition" 
without  changing  the  meaning  of  the  discussion. 

It  is  interesting  to  note  that  the  concept  of  an  ultimate  or  omega 
condition  antedates  the  use  in  the  Present  System  of  the  loads  at  limit 
condition  multiplied  by  a  factor  of  safety.  The  Wright  brothers^  designed 
their  original  airplane  structure  to  support  five  times  the  weight  of  the 
airplane.  This  corresponds  to  designing  for  what  is  now  called  an  omega 
condition.  This  practice  was  general  in  airplane  design  until  about  1934 
when  the  factor  of  safety  concept  was  introduced  into  civil  regulations. 

b.  Systems  with  Strength  Scatter  Considered 

The  assumption  made  in  the  previous  sub-section  that  all  the  vehicles  in 
the  fleet  failed  exactly  at  the  omega  condition  is  equivalent  to  saying  that 
there  is  no  scatter  in  the  strength.  Statistically,  the  coefficient  of 
variation  in  strength,  y  ,  would  be  zero.  Most  structural  systems  for  the 
aerospace  systems  of  the  paet  ware  relatively  narrow  in  strength  scatter. 
Although  the  structures  and  the  structural  design  system  did  not  make  explicit 
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determinations  of  y  ,  the.  procedures  were  consistent  with  systems  whose  ys's 
were  email  —  approaching  zero.  In  Volume  I  it  is  pointed  out  that  the 
structural  sys  ama  of  the  future  may  be  forced  to  use  materials  and  configura¬ 
tions  that  will  predispose  towards  larger  values  of  y3.  Therefore,  any  realis¬ 
tic  procedure  for  quantitative  structural  design  criteria  by  statistical 
methods  must  consider  the  effects  of  the  strength  scatter,  y3. 

It  is  part,  of  the  basic  philosophy  being  developed  in  this  section  of 
Volume  II  that  the  structural  system  should  be  developed  in  incremental  steps 
much  as  it  in  in  the  Present  System.  Th.s  means  that  strength  is  first 
calculated  analytically  for  a  set  of  analytically  determined  loads.  Then,  the 
strength  is  Vitrified  for  the  analytically  determined  loads.  Naxt,  the  loads 
are  verified  for  the  specified  operational  conditions.  Finally,  the  relation 
between  the  specified  operational  conditions  and  the  actual  operational 
experience:  is  verified  by  appropriate  means. 

As  a  result,  the  structural  requirements  are  based  on  the  premise  that, 
if  the  operational  conditions  are  as  specified,  the  structural  performance 
must  satisfy  the  desired  level  of  structural  reliability.  Obviously,  the 
reliability  of  the  structural  system  and  the  vehicle  system  will  be  deficient 
even  if  the  vehicle  is  properly  operated,  whenever  the  structure  is  incapable 
of  surviving  the  loads  associated  with  proper  operation.  Therefore,  it  seems 
appropriate  to  establish  a  structural  design  criteria  that  will  provide,  as 
a  minimum,  a  structural  system  that  will  result  in  the  desired  level  of 
structural  reliability  provided  that  the  vehicle  system  is  actually  -perated 
as  it  was  predicted  it  would  be  operated.  What  to  do  if  the  operational 
results  differ  from  the  predicted  results  will  be  discussed  later  on. 

The  basis  for  design  as  Just  described  corresponds  to  a  conditional 
structural  reliability.  It  has  many  advantages.  It  continues  to  implement 
the  decoupling  of  the  requirements  for  the  structural  and  non- structural 
systems.  It  would  seem  reasonable  that  the  definition  of  the  limit  and  omega 
operational  conditions  —  the  normal  and  abnormal  of  operations  —  should  be 
independent  of  any  consideration  of  the  type,  of  structure  that  results  from 
the  design  process.  In  other  words,  the  user  should  be  able  to  operate  an 
airplane  in  the  proscribed  manner  with  expectation  that  the  same  structural 
capability  is  being  provided  whether  there  are  forgings  or  castings  in  the 
wing,  whether  the  stru  :ture  is  "hot"  or  "cold,"  or  whether  the  wing  leading 
edge  is  aluminum,  beryllium,  or  graphite.  Therefore,  the  operational  require¬ 
ment  should  be  defines  first  and  then  adequate  structure  provided  to  most  the 
operational  requirement,  Thio  is  not  to  say  that  the  initial  desire  for 
operational  capability  may  not  be  modified  if  necessary  to  obtain  a  practical 
structure.  In  such  a  case,  there  should  be  an  explicit  agreement  that  the 
vehicle  esn  and  will  be  operated  to  more  restrictive  limitations. 

With  the  philosophy  established  that  i‘:  is  desired  to  obtain  a  particu¬ 
lar  level  of  structural  reliability  given  that  the  operational  conditions  meet 
specified  requirements,  it  is  possible  to  develop  the  naxt  step  in  the 
procedure.  Reference  5  proposed  three  levels  for  structural  reliability 
objectives.  These  are  reproduced  herein  as  Table  I.  It  is  not  suggested  that 
these  particular  sets  of  figures  must  be  adopted,  but  they  are  convenient  to 
illustrate  the  procedure  being  developed. 
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TABLE  I 


STRUCTURAL  RELIABILITY  OBJECTIVES 


Standard 

Vehicles 

Structural  Relia¬ 
bility  Goal 

0.9999 

0.999999 

0.99 

Probability  of 
Exceeding  Limit 
Condition 

0.01 

0.001 

0.1 

Probability  of 
Exceeding  Onega 
Condition 

0.0001 

0.000001 

0.01 

Conditional  Limit 
Reliability 

0.999999 

0.99999999 

0.9999 

Conditional  Omega 
Reliability 

0.99 

0.99 

0.99 

If  it  is  assumed  that  the  probability  of  exceeding  limit  condition  and 
omega  condition  will  not  be  greater  than  specified  on  Table  I,  the  structural 
reliability  that  will  be  attained  provided  that  the  structure  meets  its 
requirements  can  be  determined.  load  spectra  corresponding  to  values  of 
Table  I  are  shown  on  Figure  2.  The  important  point  of  these  curves  is  that 
the  probability  of  exceeding  the  omega  condition  is  the  congrlement  of  the 
desired  structural  reliability. 


P_  L  1 


s,r,goal 


(1) 


Then,  i  .  is  assumed  that  the  probability  that  the  strength  exceeds  the 
omega  condition  is  0.99.  This  corresponds  to  the  value  on  Table  I.  More 
important,  this  corresponds  to  what  has  been  the  practice  in  the  Present 
System  for  years.  In  effect,  the  strength  allowable  is  matched  up  with  the 
omega  load.  Based  on  these  assumptions  the  curves  of  Figure  3  are  computed 
by  the  program  described  in  Volume  III.  These  curves  show  that,  over  a  wide 
range  of  y  ,  the  structural  reliability  will  approximate  the  complement  of 
the  probability  or  exceeding  the  omega  condition, 

S.R.  x  1  -  P  (2) 

En 
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ability  of  Exceeding  Load 


7999999 


FIGURE  3-  STRUCTURAL  RELIABILITY  WITH  NO  ERROR 


provided  that  the  allowable  (99  percent  exceed  value)  is  Hatched  to  the  omega 
condition.  It  should  bo  noted  that,  at  very  large  values  of  yfl,  the  S.R. 
will  approach  0.99,  which  is  the  same  value  used  for  the  allowable. 

The  middle  curve  on  Figure  2  has  been  modified  on  Figure  4  to  show  that 
the  conclusions  drawn  in  the  preceding  paragraphs  are  not  too  sensitive  to 
the  exact  value  chosen  for  the  probability  of  exceeding  the  limit  condition. 
Figure  4  shows  two  variations  from  the  basic  curve  of  Figure  2.  The  probability 
of  exceeding  omega  is  held  constant  at  the  prescribed  value  of  1CT4,,  Tfig 
probability  of  exceeding  limit  condition  1b  also  maintained  at  the  prescribed 
10~<-,  but  limit  is  moved  up  and  down  in  relation  to  the  omega  condition.  This 
could  be  expressed  in  terms  of  factor  of  safety  with  the  basic  curve  correspond¬ 
ing  to  a  1.5  F.S.  The  two  alternate  curves  would  be  for  1.25  and  1.75  F.S. 

The  corresponding  S.R.  curves  are  computed  and  plotted  as  the  dotted  lines  on 
Figure  3- 

From  the  added  curves  it  is  apparent  that  the  shape  of  the  loading  spectrum 
does  not  have  much  effect  on  the  general  level  of  structural  reliability 
attained.  For  the  lower  values  of  strength  scatter,  the  level  of  structural 
reliability  obtained  is  governed  largely  by  the  frequency  of  exceedance  of 
the  omega  condition.  It  may  seem  obvious  but  it  is  important  to  develop  an 
appreciation  for  this  relationship.  It  is  the  basis  for  the  concept  that  the 
omega  condition  can  be  established  as  a  deterministic  value  together  with 
the  allowable  as  a  eingle  deterministic  value.  Then,  if  these  two  values  are 
established  properly,  the  structural  reliability  will  correspond  to  the  desired 
value  automatically  without  the  necessity  for  laborious  and  unprovable 
statistical  calculations .  At  this  point  in  the  development,  the  procedure 
incorporates  most  of  the  features  of  the  final  system.  These  are  summarized 
ae  follows: 

A  designated  structural  reliability  level  will  be  attained  if 

1.  The  probability  of  exceeding  the  omega  condition  is  the  complement 

of  the  desired  S.R.  =  I  -  S.R.j  ,  and  if 

2.  The  allowable  strength  of  the  structural  system  is  such  that 
99  percent  of  the  individual  structural  systems  exceed  the 
allowable  and  the  allowable  strength  equals  or  exceeds  the 
load  for  the  omega  condition,  and  if 

3.  The  coefficient  of  strength  variations,  y  ,  is  small  (i.e., 

y3  4  0.10),  and  if  3 

4.  There  are  no  mievvkes  or  errors  in  the  determination  of  the 
previous  three  parameters. 

The  last  condition  is  the  mcst  important  of  the  four,  yet  it  has  been 
completely  overlooked  in  all  previous  work  in  this  field.  Volume  I  devotes 
considerable  attention  to  this  problem.  It  is  noted  that  all  of  the  procedures 
reviewed  in  Volume  I  make  the  implicit  assumption  that  the  load  and  strength 
distributions  are  known  beyond  any  possibility  of  error.  Past  history, 
documented  by  Reference  6  and  many  other  records,  doee  not  Justify  the 
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no-error  assumption.  As  a  result,  the  calculated  S.K.'s  presented  on 
Figure  3  cannot  be  considered  to  be  realistic.  They  will  be  true  only  if 
errors  were  never  made  in  the  various  analyses  involved  in  the  confutations. 
Accordingly,  this  no-error  assumption  cannot  be  used  as  the  basis  for  a 
rational  procedure.  Therefore,  the  question  of  the  possibility  of  analytical 
errors  in  the  strength  analysis  will  do  taken  up  in  the  next  section. 

c.  Systems  with  Analytical  Errors  Considered  in  the  Strength  Analysis 

The  previous  section  developed  the  procedure  beyond  the  rudimentary 
system  of  Section  2.3a  by  considering  the  effect  of  strength  scatter  on  the 
structural  reliability.  The  section  concluded  that  the  procedure,  as  it 
stood,  was  not  realistic  because  of  the  assumption  that  there  were  no  errors 
in  the  loads  and  strength  analyses.  It  was  noted  that  Reference  6  and  other 
sources  have  documented  the  fact  that  there  have  been  many  structural  failures 
in  strength  tests  at  load  levels  considerably  below  the  predicted  level. 

Figure  5  presents  data  from  Reference  6  showing  the  frequency  with  which 
structures  fail  at  less  than  the  intended  design  load.  There  is  every 
evidence  that  ths  incidence  of  analytical  errors  today  has  not  changed 
significantly  from  that  presented  on  Figure  5.  If  this  is  true,  the  S.R. 
obtained  by  analysis  alone  will  be  dominated  by  the  error  effect.  Figure  6 
shows  this  effect.  Curve  (2)  on  this  figure  ehows  that  no  matter  what  the 
probability  of  exceeding  the  omega  condition,  the  resulting  S.R.  is  /ery  low 
(approximately  0.9).  The  spread  in  results  on  Curve  (2)  results  from 
assuming  variations,  described  in  connection  with  Figure  17,  corresponding 
to  bet. ter  or  worse  analytical  accuracy  than  that  of  Figure  5.  Figure  7, 
reproduced  from  Volume  I,  shows  that  no  matter  what  the  coefficient  of 
etrength  variation,  yg,  the  attained  S.R.  will  be  in  the  vicinity  of  0.9  when 
the  error  function  is  included  in  the  determination  of  S.R.  Both  Figures  6 
and  7  show  that  sizable  changes  in  the  error  function  from  that  of  Figure  5 
make  relatively  little  difference  in  the  attained  S.R.  Thus,  it  must  be 
concluded  that  the  simple  fact  that  analytical  errors  are  made  far  overshadows 
all  other  considerations  in  determining  the  true  structural  reliability  of 
structural  systems  designed  solely  by  analytical  techniques.  Accordingly, 
the  next  step  in  developing  a  procedure  for  quantitative  structural  design 
criteria  by  statistical  methods  must  be  to  recognize  ti  at  analytical  errors 
will  occur  and  to  expand  the  procedure  to  consider  the  ,  tatistics  of  these 
erroro  and  how  they  affect  structural  reliability.  The  computer  program 
described  in  Volume  I.II  includes  the  analytical  error  function  as  an  integral 
part  of  the  program.  The  philosophy  followed  in  developing  this  computer 
program  ie  rather  straightforward  in  terms  of  the  functions  already  discussed 
in  the  previous  sections  of  this  report.  The  logic  of  the  procedure  continues  to 
be  developed  in  the  framework  of  Professor  Draper' informatics  concept  as 
described  in  Volume  I. 

The  Actual  State  of  the  structural  reliability  of  a  particular  model  or 
design  can  never  be  known  precisely  if  it  is  acknowledged  that  errors  do 
occur  in  the  strength  analysis.  If  two  new  designs  are  considered  at  the 
earns  time,  one  model  nay  actually  have  the  predicted  strength  and  have  a 
very  high  S.R.  The  other  model  may  have  an  error  in  the  predicted  strength 
and  have  a  very  low  S.R.  Which  one  has  the  error  and  which  one  is  error-free 
cannot  be  determined  on  the  basis  of  the  analysis  alone.  Obviously,  if  it 
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FIGURE  5-  FAILURE  EUECTANCT  IN  STRUCTURAL  TESTING 
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FIGURE  6.  EFFECT  OF  EFJtOK  >  AND  TESTING  ON  STRUCTURAL  RELIAE 
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ware  taiown  that  ona  of  tha  models  Incorporated  an  error  in  the  design,  the 
error  would  ba  corrected  and  that  design  would  then  be  error-free.  The  data 
of  Figure  5  shows  that  approximately  one  out  of  every  ten  designs  hae  a 
strength  that  ie  two-thirds  of  the  intended  design  strength  or  less.  From 
this  it  can  be  concluded  that  out  of  every  100  new  designs,  ten  will  have  a 
strength  level  less  than  the  two-thirds  value.  But  which  ten  cannot  be 
determined  on  the  basis  of  the  analysis  alone.  However,  it  can  be  concluded 
that  a  brand  new  design  has  a  one- in-ten  chance  of  failing  at  two-thirds  of 
the  load  for  which  it  was  designed.  This  reasoning  is  carried  out  in  the 
program  presented  in  Volume  III  for  the  possible  range  of  error  magnitudes 
and  the  probability  with  which  they  will  occur.  The  program  is  described  in 
detail  in  Volume  III,  but  the  philosophy  of  the  approach  is  outlined  here. 

First  of  all,  it  ia  accepted  that  the  probability  of  a  test  failure  from 
Reference  6  as  shown  on  Figure  5  represent s  the  probability  of  making  an 
error  in  the  strength  analysis  of  a  given  magnitude.  This  implioitly  asoumes 
that  all  of  the  premature  failures  described  in  Reference  6  were  due  to 
discrepancies  in  design  rather  than  discrepancies  in  fabrication.  This  is 
not  quite  correct,  but  examination  of  Reference  6  indicates  a  large  majority 
of  the  failures  were  caused  by  design  errors.  Rather  than  attempting  to 
determine  the  exact  value  of  the  failures  attributable  to  design  errors  (which 
value  would  be  subject  to  challenge  with  each  different  organisation  involved 
and  each  change  in  technology  considered),  it  is  shown  later  that  the 
computed  results  are  not  very  sensitive  to  the  specific  error  function 
assumed. 

A  mathematical  expression  ia  presented  in  Volume  III  approximating  the 
empirical  function  shown  on  Figure  5 •  The  derivative  of  this  function  is 
the  probability  density  function  cf  analytical  error.  This  derivative  of  the 
error  function  is 


P3U5)  =3.718  x.,2*7l8/(xdp) 


3.718 


(3) 


In  this  equation,  x,  is  the  randomly  distributed  location  of  the  mean  strength, 

and  x,  ia  a  "design  point,"  which  is  derived  from  the  error  data  in  Reference  6. 
op 

The  value  for  used  In  the  computer  program  described  in  Volume  III  is 
1.06796  My,  where  i8  the  theoretical  mean  strength  associated  with  a 


specified  allowable,  the  fraction  of  the  structures  that  exceed  the  allowable 
and  the  coefficient  of  strength  variation,  y  .  Simply  stated,  this  function 

j^P3  (Xj)j  »  multiplied  by  the  width  of  the  integrating  interval  being  used, 

represents  the  fraction  of  the  new  designs  whose  mean  strength  will  be  in  the 
interval  x^  to  Xj  +  Ax^  when  the  intended  design  strength  was  close  to  the 

design  point  x^.  In  the  analysis  it  would  be  calculated  that  the  "allowable" 


strength  (usually  the  99-p jrcent-exceed  strength)  was  equal  to  the  required 
strength.  The  probability  density  function  (Gaussian)  for  a  structural  system 
whose  mean  ie  x^  can  be  written  as 
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(4) 


The  probability  that  the  particular  system  whose  mean  is  x,  will  fail  in  the 
interval  +  A  xi  can  be  written 


Ap25(xi)  =  P1(xi,  Xj )  p3(Xj)Ax^Axi 


(5) 


Qualitatively,  the  situation  can  be  clarified  by  a  sketch  showing  the  relation¬ 
ship  involved.  From  equation  (3)  it  can  be  calculated  that  2.4  percent  of  the 
systems  intended  to  have  their  design  strength  at  150  will  actually  have  the 
mean  between  95  and  105.  Of  those  2.4  percent  whose  mean  is  in  the  95-105 
interval,  6.1  percent  will  fail  in  the  interval  from  75  to  85.  This  determines 
that  the  probability  that  the  mean  of  the  group  is  between  95  and  105  and  that 

one  particular  vehicle  from  the  group  will  fail  in  the  interval  75  to  85  it 

0.024  x  0.061  *=  0.00146.  Since  it  is  not  known  where  the  mean  really  is,  the 

possibility  that  the  mean  might  be  at  any  value  of  x  must  be  considered.  For 

instance,  Figure  8  shows  that  4.38  percent  of  the  designs  will  have  their  mean 
strength  from  120  to  130.  The  probability  that  an  individual  article  from  this 
group  will  fail  in  the  interval  75  to  85  is  0,00066.  Then,  the  probability  that 
the  mean  will  be  at  125  and  have  a  failure  at  80  is  0.0438  x  0.00066  =  0.00003. 
Now,  tho  probability  of  failure  at  80  from  these  two  possibilities  is  0.00146  + 
0.00003  =  0.00149.  To  get  the  total  probability,  the  integration  must  be 
performed  over  the  whole  rarje  of  possible  x  ,'s,  not  just  the  two  used  for  the 
illustration.  J 

It  must  be  understood  that  any  one  vehicle  system  cannot  have  its  mean 
strength  at  all  of  the  infinity  of  the  possible  valuse  as  might  be  thought 
whsn  the  procedure  Integrates  over  the  whole  range  of  possible  Xj's.  Each 

particular  vehicle  system  has  a  particular  value  of  mean  strength  associated 
with  that  system.  But  the  particular  value  is  unknown.  Therefore,  it  must 
be  considered  that  there  is  a  chance  that  the  mean  strength  is  at  any  of 
the  values.  Thus,  aquation  (3)  expresses  the  probability  that  the  actual 
value  of  the  unknown  mean  is  at  x..  The  integration  of  the  product  of  the 
chance  that  the  mean  strength  is  at  Xj  and  the  chance  that  an  individual 
vehicle  strength  is  at  represents  the  probability  that,  in  a  conqolex  of 
systems  as  described  in  Section  3-4  of  Volume  I,  an  individual  vehicle  will 
fail  at  x^.  Since  the  statistical  parameters  for  the  individual  system  are 

not  known,  equation  (5)  represents  all  that  is  known  about  a  newly-designed 
structural  system  after  the  design  is  complete  but  before  any  strength  tests 
or  operational  data  are  available. 

A  slightly  different  description  of  tha  problem  of  defining  the  S.R.  of 
a  new  design  may  be  useful  in  developing  an  ui.ier standing  of  the  effect  of 
analytical  errors  on  the  S.R.  Fig.ire  9  shows  a  representation  of  the  initial 
(before  test)  strength  distributions  on  a  hypothetical  group  of  different 
structural  systems.  These  systems  from  A  to  T  could  be  thought  of  as  typical 
structures  designed  by  various  contractors  for  various  different  vehicle 
models.  The  strength  of  all  of  the  designs  was  intended  to  be  as  indicated 
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FIGURE  8.  FAILURE  DISTRIBUTION  COMPOSITION 


FIGURE  9.  STRENGTH  DISTRIBUTION  IN  A  COMPLEX  OF  SYSTEMS  (WITHOUT  TEST) 
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on  tha  top  Una  for  the  analytical  prediction.  No  specific  calculation  of 
thia  distribution  was  made  in  tha  design  of  past  structures.  Nevertheless , 
if  the  99-peroent-exceed  "allowable"  was  properly  matched  to  the  design  load, 
a  distribution  auch  as  ahown  on  tha  top  lina  of  Figure  9  would  be  the  result. 
Because  of  analytical  errora  in  the  various  designs,  the  actual  strength 
distributions  before  teet  would  be  located  as  ahown  on  Figure  9.  The  hypoth¬ 
esized  distribution#  are  consistent  with  the  data  of  Reference  6  and  Figure  5. 
Because  of  errors  in  tha  analysis  more  than  half  of  the  vehicles  will 
fail  at  less  than  the  design  load.  Sons  of  the  strengths  will  be  randomly 
higher  than  the  mean  strength  of  tha  particular  system  and  soma  will  be  lower. 

If  a  new  system  designated  System  X  has  been  designed  and  analyzed  with 
the  expectation  of  obtaining  a  distribution  corresponding  to  (1)  by  procedures 
comparable  to  those  ussd  on  System  A  to  T,  the  actual  distribution  might  be 
that  of  (1),  (2),  (3)  or  any  intermediate  distribution.  The  true  location  of 
the  distribution  mist  be  considered  to  be  unknown.  If  no  strength  teat  is 
conducted,  it  oust  be  assumed  that  the  chances  of  the  mean  strength  being  low 
are  the  same  as  they  were  in  the  past  as  represented  by  the  distribution  of 
the  means  of  Systems  A  through  T.  If  the  Systom  X  strength  happens  to 
correspond  to  distribution  (l),  the  system  probability  of  failure  will 
approximate  10“^  (Figure  9  assumes  that  the  probability  of  exceeding  the 
design  load  is  10“^).  However,  if  the  strength  happens  to  correspond  to  (2), 
the  probability  of  failure  might  be  IQ--',  and  if  the  strength  distribution 
is  like  (3),  the  probability  of  failure  might  be  0.8. 

If  all.  of  the  various  possibilities  are  considered  and  integrated  by  the 
program  of  Volume  IIJ,  the  "with  error  —  no  test"  curves  of  Figures  6  and  7 
are  obtained.  From  this  type  of  information,  a  decision  can  be  made.  Even  if 
the  load  spectrum  is  exactly  as  predicted  (Pg^  =  10“^),  the  probability  of 

failure  in  all  operations  of  future  Systems  X,  taken  as  a  group,  will  be  far 
greater  than  the  tolerable  value  of  10-^  and  will  approximate  10-1.  por  this 
reason,  a  decision  can  be  made  that  System  X,  as  it  stands,  with  a  complete 
analysis  but  r.o  strength  teet,  does  not  have  the  desired  0.9999  S.R.  It  mist 
be  understood  that  in  some  cases  the  true  distribution  of  System  X  is  distri¬ 
bution  (1).  In  that  case,  the  S.R.  really  is  about  0.0999.  For  such  systems 
the  decision  would  be  a  wrong  decision.  But  there  wilx  also  be  System  X‘s 
with  distributions  (2)  and  (3)  where  the  decision  would  have  been  a  correct 
decision. 

Taken  over  a  period  of  time  the  next  20  systems  designed  without  a 
strength  teat  must  be  expected  collectively  to  have  the  same  characteristics 
as  Systems  A  through  T.  If  so,  about  one  out  of  ten  of  the  vehicles  involved 
would  fall  in  operation.  Obviously,  most  of  the  failures  would  be  in  systems 
comparable  to  E,  K  and  S.  Very  few  If  any  would  be  in  tystema  A,  C,  F,  G,  H, 
etc.  But,  until  the  failures  began  to  occur,  no  one  would  known  which  systems 
were  the  E,  K  and  S's.  The  deaigners  of  System  X  might  be  very  confident  that 
"their"  system  was  error-free.  But  it  must  be  remembered  that  the  designers 
of  Systema  A  through  T  were  equally  confident.  More  than  half  of  them  were 
wrong  in  their  confidence.  It  would  be  presumptuous  for  the  future  designers 
of  System  X  to  assume  that  they  alone  could  design  a  million  or  even  a 
thousand  structures  without  ever  faltering  and  producing  9.  System  E,  k,  or  S. 
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In  tarns  of  the  functional  diagram  of  Figure  1,  the  best  information 
available  as  part  of  the  Actual  State  Information  System  says  that  a 
decision  should  be  made  that  the  actual  S.R.  of  a  newly  designed  structural 
system,  before  strength  test,  must  be  approximately  0.9.  The  S.R.  may  be 
higher  but  such  a  decision  cannot  be  made  on  the  basis  ol  past  experience. 

To  decide  otherwise  should  require  a  preponderance  of  evidence  to  show  why 
the  past  experience  will  be  improved  upon.  In  other  words,  the  burden  of 
the  proof  should  be  on  anyone  who  chooses  to  assume  that  the  future  record 
will  be  better  than  the  past. 

The  improvement  in  analytical  accuracy  would  have  to  be  substantial 
before  much  improvement  in  S.R.  would  result.  Figure  5  shows  that  about  one 
in  one-hundred  test  structures  fail  at  one-third  the  design  load.  If  this 
were  improved  tenfold  to  one  in  a  thousand,  the  S.R.  would  improve  less  than 
an  order  of  magnitude  as  shown  on  Figures  6  and  7.  Furthermore,  the 
consequences  of  deciding  to  accept  a  system  like  E,  K,  or  S  are  so  drastic 
that  the  "accept"  decision  should  be  made  only  on  the  soundest  possible  basis. 

Since  it  can  be  decided  that  a  new  structural  system  does  not  have  a 
provable,  before-best  structural  reliability  greater  than  about  0.9,  such 
structures  could  not  be  considered  to  have  met  any  of  the  desired  levels  of 
S.R.  listed  on  Table  I.  If  this  be  so,  on  what  basis  can  a  decision  be  made 
that  the  S.R.  is  sufficiently  high?  The  next  shews  that  testing  will  provide 
some  answers  to  the  problem. 

d.  Error  Disclosure  by  Testing 

(1)  Error  Disclosure  Principles 

The  previous  section  showed  that  the  structural  reliability  of  systems 
that  have  not  bean  strength  tested  is  inevitably  much  lower  than  desired 
because  of  the  possibility  of  analytical  error.  If  a  large  number  of  tests 
of  the  structural  system  could  be  conducted,  the  strength  distribution  could 
be  determined  accurately  and  the  possibility  that  there  was  an  error  in  the 
analysis  would  not  need  to  be  considered.  However,  Volume  I,  quoting  Taylor 
and  Lusser,  notes  that  a  rule  of  thumb  for  the  number  of  specimens  required 
to  estimate  the  chance  of  failure  is  ten  times  the  reciprocal  of  the  chance. 
This  means  that  if  the  relatively  modest  reliability  of  0.9999  were  the  goal, 
one-hundred  thousand  specimens  would  have  to  be  tested.  Grose?  has  pointedly 
observed  that  funding  of  test  programs  to  prove  reliability  numbers  like  this 
would  bankrupt  the  nation.  It  is  obviously  not  feasible  to  determine  the 
structural  reliability  of  a  vehicle  by  experimental  means. 

A  different  approach  is  necessary.  The  philosophy  was  developed  in 
Reference  8  that  the  function  of  testing  is  to  act  as  an  error  "discloser," 
not  a  reliability  "prover."  If  a  single  test  article  fails  to  pass  a  specific 
strength  test,  it  can  be  considered  that  this  test  failure  has  disclosed  an 
error.  This  action  still  does  not  prove  what  the  reliability  actually  is, 
either  before  or  after  the  test.  The  rejection  of  understrength  designs  by 
means  of  the  test  is  not  absolute.  The  strength  of  individual  articles  of 
any  particular  design  has  a  distribution  about  the  mean  strength,  wherever 
that  mean  is.  A  test  article  from  a  system  whose  mean  strength  is  much  lower 
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than  the  test  lead  may  survive  the  test.  This  would  occur  if  the  test 
article  randomly  happened  to  be  much  higher  in  strength  than  the  mean.  Such 
a  possibility  must  be  considered  in  determining  the  structural  reliability  of 
a  design  after  one  or  more  test  articles  have  passed  a  designated  test. 

The  main  concern  is  whether  a  system  that  is  significantly  understrength 
will  pass  the  strength  test.  Reference  9  presents  a  discussion  showing  that 
a  system  whose  mean  is  at  100  and  whose  strength  scatter  is  0.05,  similar  to  the 
axanple  on  Figure  8  of  thia  report,  will  have  a  probability  of  surviving  a 
test  to  150  of  only  10-^*.  In  such  case,  the  probability  previously  computed 
to  be  0.00146  becomes  0.00146  x  10-24,  or  approximately  10-27.  This  means 
that  the  possibility  of  failure  at  80  has  been  reduced  to  a  negligible  value 
for  a  system  whose  design  strength  was  intended  to  be  150  but  which  happened 
to  have  its  mean  at  100  and  which  had  successfully  passed  a  strength  test  to 
150.  It  cannot  be  emphasised  too  strongly  that  this  high  degree  of  certainty 
in  the  rejection  of  all  grossly  understrength  systems  is  the  key  to  the  new 
procedure  described  in  thia  report. 

In  the  previous  discussion  it  was  pointed  out  that  the  reliability  goal 
would  be  attained  if  the  frequency  of  exceeding  the  omega  condition  was  equal 
to  the  complement  of  the  desired  S.R.  and  if  the  allowable  corresponded  to 
the  omega  load.  But  then  it  was  pointed  out  that  the  frequency  of  making 
smalytical  errors  results  in  the  error  function  dominating  the  structural 
reliability  determination.  Then,  the  strength  test  is  described  as  an  error 
discloser  reducing  the  probability  that  an  understrength  structural  system 
will  be  accepted  for  operations.  The  criteria  problem  is  to  provide  a 
procedure  to  decide,  after  a  test  is  conducted,  whether  or  not  to  accept  for 
operations  a  newly-designed  structural  system. 

The  probability  that  a  particular  system  will  have  a  low  mean  strength 
but  still  pass  a  teat  to  a  significantly  higher  load  is  drastically  reduced 
from  the  probability  of  being  at  that  level  if  no  test  is  conducted.  For 
instance,  a  system  such  as  "Q"  on  Figure  9  has  a  probability  of  1  *-31500  that 
it  will  pass  a  test  to  the  design  load.  Earlier,  it  was  noted  that  systems 
like  E  and  S  have  only  one  chance  in  10^*  of  passing  the  tests.  Therefore, 
alnrcst  all  the  low  strength  systems  on  Figure  9  will  fail  prematurely  during 
the  test,  disclosing  their  weakness.  It  is  almost  immaterial  that  System  E 
may  fail  slightly  on  the  high  side  of  its  mean  strength  and  System  S  slightly 
on  the  low  side.  Both  are  so  low  that  the  situation  can  only  be  the  result 
of  a  gross  miscalculation  of  the  design  strength.  In  most  cases,  the  cause 
of  the  problem  is  evident  immediately  after  the  failure. 

It  is  assumed  that,  in  each  case,  the  design  is  corrected  as  necessary 
after  a  test  failure  and  then  retested  until  the  required  test  load  is 
sustained.  This  has  the  effect  of  eliminating  the  deficient  design  and 
replacing  it  with  a  stronger  design.  The  effect  of  this  on  the  systems 
pictured  on  Figure  9  is  shown  on  Figure  10.  Several  pertinent  and  interesting 
situations  are  depicted  on  Figure  10.  System  C  is  a  system  with  no  error  in 
the  analysis,  yet  it  happened  to  fail  elightly  below  the  required  test  load. 
Thia  will  happen  occasionally  where  there  is  a  scatter  in  the  distribution  of 
failing  strength.  It  cannot  be  helped.  The  redesign,  as  shown  on  Figure  10, 

Is  minimal.  Such  redesigns  of  a  truly  acceptable  system  will  be  rare.  In 
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FIGURE  10.  STRENGTH  DISTRIBUTION  IN  A  COMPLEX  OF  SYSTEMS  (AFTER  TEST) 
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affect,  they  become  pert  of  the  coat  of  obtaining  truly  reliable  structural 
systems.  As  far  as  S.R.  is  concerned,  the  redesigned  System  C  is  more 
reliable  than  necessary  so  it  is  obviously  acceptable. 

System  0  is  slightly  understrength  but  passed  the  test  successfully. 

It  will  become  operational.  It  is  doubtful  that  the  underat rength  will  ever 
be  apparent  because  most  of  the  System  G  structures  would  have  to  be  loaded 
to  about  145  to  150  percent  of  the  limit  load  before  they  failed.  This,  of 
course,  still  represents  a  gross  overload.  In  any  accident  investigation,  it 
would  almost  certainly  be  concluded  that  System  G  was  overloaded,  not  that  it 
was  understrength. 

System  K  shows  a  system  failing  well  belcrw  limit  load,  being  strengthened, 
and  failing  a  second  time.  After  the  second  strengthening,  the  system  passes 
the  test.  Reference  6  records  many  instances  of  repeated  failures  on  the  same 
structure.  The  rolnt  to  remember  is  that,  after  a  reasonable  number 
of  tests  and  strengthening,  the  structure  can  finally  be  considered  reliable. 

This  is  not  the  same  thing  as  repeatedly  tesv Ing  the  eame  design  until  finally 
the  random  structure  that  is  any  arbitrary  amount  over  the  mean  strength  is 
found  and  it  alone  of  all  the  structures  tested  is  successful.  Neither  is  it 
the  same  thing  as  testing  5  or  10  nominally  identical  structures  and  requiring 
that  they  all  survive  the  tost  the  first  time. 

System  Q  is  shown  with  a  strength  that  happens  to  be  substantially  below 
the  design  strength  but  which  qualified  for  operation  because  of  an  extremely 
rare,  random  high  strength  for  the  test  article  relative  to  the  mean  strength. 

Even  this  such  deviation  from  the  desired  strength  will  only  increase  the 
failure  rate  from  one-in-ten-thou.sand  to  one-in-a-thousand.  This  System  Q 
illustrates  the  point  that  one  test  cannot  guarantee  that  each  and  every 
design  will  achieve  the  desired  S.R.  What  is  accomplished  is  that  the 
Incidence  of  Syatem  Q's  that  are  accepted  inadvertently  will  be  very  small 
compared  to  the  overall  failure  rate  that  is  considered  to  be  tolerable.  If 
al 1  the ( Systems  A  through  T  depicted  on  Figure  10  are  considered  collectively 
as  one  complex  of  systems,  the  total  probability  of  a  new  system  failing 
during  operation  can  be  calculated  considering  the  probability  of  analytical 
error  and  the  probability  of  disclosing  the  error  during  a  strength  test. 

(2)  Test  to  Omega  (Ultimate)  Loads 

A  series  of  curves  such  as  those  on  Figure  11  can  be  calculated,  using 
the  program  described  in  Volume  III,  to  show  the  structural  reliability  that 
will  be  attained  with  consideration  of  the  probability  of  analytical  errors 
according  to  equation  (3)  and  the  probability  of  disclosing  the  error  by  one 
test  to  omega  (ultimate)  load.  The  data  on  Figure  11  is  based  on  the 
assumption  that  the  loading  spectrum  is  defined  by  two  points.  The  probability 
of  exceeding  the  omega  load  is  equal  to  the  complement  of  the  desired  S.R.  and 
the  probability  of  exceeding  limit  is  as  shown  on  Table  I. 

As  long  as  the  probability  of  exceeding  the  omega  load  corresponds  to  the 
value  listed  on  Table  1,  the  corresponding  S.R.  will  be  attained  over  a  wide  range 
of  other  pertinent  variables.  If  operational  faetore  of  safety  considerably 
higher  or  lower  than  1.5  are  associated  with  the  loads  while  the  probability 
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FIGURE  LI.  STRUCTURAL  RELIABILITY  -  STANDARD  ERROR  FUNCTION  -  ONE  TEST 


of  axcaeding  limit  remains  at  the  suggested  value  from  Table  x,  the  resulting 
load  epeotra  would  be  ae  shown  on  Figure  4.  The  level  of  S.R.  attained  dose 
not  vary  significantly.  This  phenomenon  is  shown  for  the  middle  S.R.  group 
on  Figure  11.  An  alternative  interpretation  on  Figure  4,  that  would  not 
affect  the  results  of  Figure  11,  is  to  considor  that  the  load  at  6 7  percent 
of  omega  is  the  limit  load  for  all  three  spectra.  Then,  these  spectra  become 
three  versions  of  spectra  where  the  F.S.  equals  x.5  but  the  probability  of 
exceeding  limit  load  varies  from  0.0?  to  0.0038.  Either  way,  the  conclusion 
to  be  drawn  is  that  the  probability  of  exceeding  omega  load  is  the  major  factor 
determining  the  level  of  S.R.  achieved  after  testing  to  that  omega  load. 


Examination  of  Figure  11  discloses  that  the  desired  S.R.  is  equaled  or 
exceeded  at  the  low  and  moderate  values  of  yg,  but  is  not  attained  at  the 

larger  values  of  yfl.  This  reduction  in  S.R.  at  the  large  valuss  of  Yg  is  due 

to  the  greater  probability  of  a  system  passing  the  test  with  a  randomly  high- 
strength  article  and  then  failing  in  operatiens  with  a  randomly  low-strength 
vehicle.  If  a  eystem  such  as  System  Q  on  Figure  10  with  its  mean  strength 
midway  between  limit  and  ultimate  load  is  considered,  the  difference  between 
a  low-scatter  and  a  high-scatter  system  can  be  clarified.  Suppose  that 
System  Q  is  presented  for  static  teat.  It  was  previously  noted  that  there 
is  a  1:31500  ohancs  of  passing  the  test.  The  chance  of  this  system  failing 
at  limit  load  is  also  1:31500  (Gaussian  distribution  assumed).  The 
probability  of  passing  the  test  to  ultinate  load  and  subsequently  failing  at 


limit  load  is 


_ L_  x  — 

31500  31500 


which  is  a  probability  of  about  10"^.  This 


probability  is  predicated  on  System  Q  having  a  y3  =  0.05.  If  Yg  equaled  0.20, 
the  probability  of  the  two  events  occurring  is  markedly  increased  to  more 
than  10“ ^  (seven  orders  of  magnitude  greater).  With  the  0.20  scatter,  the 
chance  of  passing  the  test  has  gone  up  to  about  1:6  and  the  chance  of  aub- 
sequently  failing  at  limit  load  is  1:6.  The  computer  program  of  Volume  III 
integrates  the  cumulative  effects  on  S.R.  of  the  possibility  that  the  mean 
strength  is  at  any  of  the  many  possible  levels  instead  of  the  single  level 
used  for  illustrations  here.  Nevertheless,  this  example  should  serve  to  spot¬ 
light  the  underlying  reason  for  a  decrease  in  attained  S.R.  at  high  y  . 


(3)  Onega  Test  Factor  of  Safety 


Reference  9  proposed  that  any  desired  level  of  structural  reliability 
could  be  achieved  by  a  suitable  choice  of  the  test  load.  Although  test  loads 
have  traditionally  coincided  with  the  ultimate  design  load  in  the  past,  there 
is  no  Inherent  reason  why  this  should  be  so.  If  the  test  load  is  increased 
beyond  the  ultimate  or  omega  load,  there  is  a  greater  probability  that  the 
understrength  structure  will  be  disclosad  and  any  necessary  redesign 
accomplished.  The  magnitude  of  the  required  increase  has  been  determined  by 
the  conputer  program  of  Volume  III  and  presented  on  Figure  12.  It  is 
immediately  apparent  that  no  extra  factor  is  needed  for  the  region  of 
relatively  low  Yg.  Since  this  is  the  region  where  most  aerospace  structural 

systems  of  the  past  have  bean  located,  due  largely  to  the  unwritten  miss  and 
and  general  state-of-the-art  considerations,  the  past  practice  of  testing  onl> 
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to  the  ultimata  (omega)  load  is  Justified  by  Figure  12.  It  would  have 
raised  serious  doubts  concerning  the  validity  of  Figure  12  if  the  proposed 
procedure  had  called  for  TFS  greater  than  1.0  at  the  lower  values  of  y  . 

It  has  generally  been  accepted  that  structural  materials  should  be 
ductile  which  has  minimized  the  scatter  of  failing  loads  due  to  brittle 
material  structures.  Structures  that  were  overly  sensitive  to  dimensional  or 
chemical  variation  have  been  avoided.  Use  of  materials  beyond  the  "knee"  of 
the  strength/temperature  curve  has  been  avoided.  By  such  techniques,  a  low 
value  of  has  been  achiavsd  for  most  structural  systems  in  the  past, 
without  an  express  requirement  for  a  low  y  .  Kost  of  the  limitations  mentioned 
above  are  necessarily  being  violated  in  the  structures  designed  for  the 
advanced  vehicles  of  the  present  and  future. 

If  the  omega  TFS,  as  shown  on  Figure  12,  ie  used  to  define  the  test 
conditions,  the  S.R. 'a  for  the  three  levels  of  loading  spectra  are  all  equal 
to  or  greater  than  the  desired  S.R.  as  shown  on  Figure  13.  The  middle  group 
of  curves  ehows  the  variation  in  the  predicted  S.R.  if  F.S.  larger  and  smaller 
than  1.5  are  considered  and  if  appropriate  omega  TFS  as  shown  on  Figure  Li,  is 
used.  Rather  than  specify  a  set  of  omega  TFS  curves  as  in  Figure  14,  it  is 
considered  preferable  to  use  a  single  curve  for  each  level  of  S.R.  desired, 
as  shown  on  Figure  12*  In  this  case,  the  S.R.  will  vary  somewhat  from  the 
desired  value  of  0.9999,  but  will  be  a  good  approximation  of  the  value  as 
shown  on  Figure  15. 

Having  shown  that  the  S.R.  resulting  from  use  of  the  curves  of  Figure  12 
arc  not  affected  oignificantly  by  major  variations  in  the  F.S.  relationship 
between  lindt  and  omega  conditions,  the  effect  of  differences  in  the  assump- 
tions  governing  other  parametero  should  be  examined.  The  curves  on  Figures  11 
through  15  are  confuted  with  the  assumption  that  the  distributions  involved 
are  Weibull  distributions.  The  program  of  Volume  III  can  accept  normal 
(Gaussian)  and  log-normal  assumptions  as  well.  The  middle  curve  of  Figure  13 
has  b^en  recomputed  using  these  two  assumptions.  The  resulting  S.R.' 3  are 
shown  on  Figure  16.  Finally,  the  sensitivity  to  different  assumptions  for 
the  error  function  of  Figure  5  and  equation  (3)  are  examined.  The  computer 
program  has  provisions  for  varying  this  error  function  as  described  in 
Volume  III.  The  sensitivity  is  examined  by  assuming  that  the  analytical 
accuracy  ie  10  times  better  (fewer  errors)  than  documented  by  Reference  6  or 
10  times  worse  (more  errors).  The  results  of  this  analysis  are  shown  on 
Figure  17. 

It  is  obvioue  that  the  coefficient  of  strength  scatter,  Y  ,  is  a  very 
important  parameter  in  the  nerw  procedure.  Since  it  has  not  been  explicitly 
considered  in  the  SDC  of  the  past,  the  available  data  on  Yg  is  limited.  This 

problem  will  be  discussed  further  in  Section  VII.  However,  the  S.R.  resulting 
from  design  by  analysis  and  test  is  not  overly  sensitive  to  errors  in  the 
determination  of  Fs.  Figure  18  snows  the  S.R.  that  will  result  if  Yg  Is 

actually  twice  the  value  predicted.  It  is  very  unlikely  that  a  miscalculation 
of  this  magnitude  will  be  made  once  some  experience  in  predicting  ys  ie 
attained. 
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FIGURE  18 .  EFFECT  OF  ERROR  IN  PREDICTED  SCATTER 


If  ths  results  from  all  of  thass  varied  assumptions  are  combined  as  on 
Figure  19,  it  appears  that  a  good  approximation  of  the  desired  S.R.  is 
obtained  so  long  as  three  conditions  are  met.  These  are:  (1)  the  frequency 
of  exceeding  the  omega  condition  corresponds  to  the  complement  of  the  desired 
structural  reliability,  (2)  the  design  allowables  are  matched  analytically 
(zero  M.S.)  to  design  loads  obtained  by  multiplying  the  loads  at  omega  condi¬ 
tions  by  the  omega  TFS  shown  on  Figure  12,  and  (3)  a  representative  test 
article  sustaine  the  loads  corresponding  to  the  design  conditions.  From  this 
theoretic  1  analysis  of  the  S.R.  that  would  be  attained,  a  practical  adminis- 
trable  procedure  for  etructural  design  criteria  becomes  feasible.  The  goal 
is  established  as  a  particular  S.R.  number  such  as  one  of  those  in  Table  I, 
but  the  proof  of  compliance  is  the  physical  act  of  successfully  completing  a 
strength  test  to  loads  governed  by  Figure  12. 


As  discussed  in  Section  2.3d(l)  the  purpose  of  tho  strength  test  is  to 
disclose  errors  In  the  analysis.  In  3ection  2.3d(2)  it  was  described  how 


System  Q  had  a  — i —  x  — - — 
7  31500  *  31500 


chance  of  passing  the  test  to  the  design  load 


and  then  failing  at  limit  load.  If  a  aecond  teat  were  run  and  both  tests 
were  successful,  the  probability  of  passing  this  dual  test  and  then  failing 


at  limit  load  becomes 


31500 


,  an  extremely  unlikely  possibility. 


The  decrease  in t he  probability  of  two  consecutive  random 
the  teot  for  the  example  where  >'s  was  C.20  becomes  : 


structures  passing 
This  is  almost 


4- 


an  order  of  magnitude  improvement  in  the  S.R.  that  results  from  this  second  test. 


This  increment  in  the  S.R.  resulting  from  two  or  more  successful  tests 
to  tho  same  load  decreases  the  need  to  test  to  ae  high  a  test  load.  The 
program  described  in  Volume  Ill  has  the  capability  to  consider  such  multiple 
testa.  The  omega  TFS  needed  for  multiple  tests  is  shown  on  Figure  20,  These 
curves  correspond  to  the  middle  curve  on  Figure  12. 


This  procedure  becomes  a  feasible  device  for  making  a  positive  decision 
that  a  design  complies  with  a  set  of  requirements  that  are  statistically 
based  in  the  face  of  numerous  uncertainties  that  affect  the  exact  determination 
of  the  structural  reliability  of  a  particular  vehicle.  As  Figure  19  shows, 
the  result?  will  be  close  to  the  desired  results.  The  departure  from  tne 
precise  value  of  the  desired  results  will  never  be  provable.  These  small 
disc.-epar.cic3  will  be  “-'sorbed  in  ether  discrepancies  such  as  the  icct  that 
the  vehicle  ordinarily  is  not  operated  throughout  its  service  life  precisely 
as  predicted  at  the  beginning  of  its  service.  To  try  to  resolve  the  various 
unknowns,  such  ae  the  true  shape  of  the  strength  distribution  curve,  to  reduce 
the  scatter  ehown  on  Figure  19  is  essentially  impossible.  It  is  feasible  to 
make  a  parametric  study,  such  as  represented  by  Figure  19  ,  and  decide  that 
the  variations  produced  by  any  reasonable  assumption  are  in  the  range  of 
acceptable  departure  from  the  precise  number  established  as  the  desired  value. 

It  cannot  be  emphasized  too  strongly  that  the  decision  that  the  structural 
system  complies  with  the  requirements  which  in  turn  were  based  on  a  designated 
structural  reliability  goal,  does  not  guarantee  that  the  S.R.  will  actually 
be  at  the  desired  level.  On  rare  occasions,  such  as  represented  by  System  Q 
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FIGURE  19.  COMPOSITE  EFFECT  OF  ERRONEOUS  PREDICTION 
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on  Figure  10,  the  etructural  system  will  be  accepted  when  it  should  not  have 
been.  Figure  21  shows  the  results  of  such  a  situation.  A  plot  of  the 
failure  density  distribution  for  three  levels  of  understrength  are  shown 
superimposed  on  the  load  distribution.  From  this,  it  can  be  concluded  that, 
at  whatever  level  the  mean  strength  falls,  most  of  the  failures  occur  very 
close  to  that  level.  A  derivative  of  this  conclusion  is  that,  if  a  failure 
does  occur  at  any  level  significantly  below  the  omega  condition  during 
operational  usage,  it  may  be  decided  automatically  without  any  further 
analysis  that-  the  failure  is  caused  by  a  deficiency  in  the  structural  system. 
Further,  it  can  be  concluded  that  the  probability  cf  failure  will  correspond 
approximately  to  the  originally  predicted  probability  of  exceeding  the-  condi¬ 
tion  at  which  the  one  failure  occurred.  If  operations  are  continued  without 
changing  the  structural  system,  additional  failures  can  bo  expected  every 
time  the  operational  conditions  approximate  the  level  where  the  first  failure 
occurred.  Thia  capability  to  decide  is  vital  to  the  administrative  practicality 
of  the  proposed  procedure.  This  capability  overcomes  one  of  the  problem  areas 
for  the  Purely  Statistical  Structural  Reliability  System  as  described  in  the 
evaluation  of  that  system  in  Section  3*4  of  Volume  I.  It  was  noted  in  that 
evaluation  that  statistical  data  on  structural  failures  and  successes  during 
operational  usage  of  the  vehicle  are  inevitably  insufficient  to  make  decisions 
as  to  the  cause  of  an  operational  failure  and  the  corrective  action  to  be 
taken. 


(4)  limit  Test  Factor  of  Safety 

The  procedure  developed  to  thie  point  has  shown  how  it  is  possible  to 
make  decisions  on  a  deterministic  basis  that  a  structural  system  has  attained 
a  designated  structural  reliability.  If  this  were  the  only  definition  of  the 
Desired  State  of  the  structure,  the  procedure  would  be  conqjlete.  However, 
there  are  other  considerations  that  should  be  introduced.  These  will  modify 
the  procedure  somewhat  but  will  not  change  the  basic  approach.  The  first  of 
these  is  to  bring  the  limit  Condition  into  the  picture.  In  the  development 
of  a  rudimentary  system  in  Section  2.3a»  the  concept  was  introduced  of  the 
limit  Condition  representing  the  upper  limit  or  boundary  of  operational 
conditions  that  could  be  called  normal  or  expected.  Since  limit  Conditions 
are  norral,  they  are  permitted  conditions.  The  earlier  discussions  suggested 
that  a  desirable  goal  would  bo  no  failures  at  Limit  Condition  or  less.  This 
is  not  a  feasible  goal  so  a  finite  probability  of  failure  was  suggested,  in 
Reference  5  and  tabulated  on  Table  I.  The  particular  values  listed  on 
Tablet  \  are  based  on  an  arbitrary  decision  that  no  more  than  one  percent  of 
the  toial  failures  permissible  should  occur  at  limit  or  less.  The  choice  of 
or.e  percent  has  a  rationale  that  should  Justify  its  use.  However,  other 
values  could  bp  selected  if  later  developments  appear  to  warrant  it. 

The  basic  Justification  of  the  one-percent  requirement  is  that  failures 
due  to  underatrength  have  traditionally  been  less  acceptable  in  aerospace 
vehicles  than  failures  due  to  overload.  Therefore,  it  is  not  considered 
reasonable  to  establish  a  goal  that  would  accept  the  occurrence,  in  the  range 
that  suet  be  considered  understrength,  of  more  than  a  small  proportion  of 
whatever  total  nunfcer  of  failures  will  be  tolerated.  Ely  definition,  operations 
in  this  range  are  permissible.  The  requirement  applied  to  a  high-risk,  military 
vehicle,  such  as  a  fighter  airplane,  can  illustrate  intuitively  the  need  for 
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FIGURE  21.  FAILURE  DI'IIRIBUTIONS  FOE  VAJUOUS  DESIGN  LOADS 


the  one-perceni,  requirement.  If  the  structural  reliability  goal  of  0.99, 
suggested  on  Table  I  were  tc  be  adopted,  it  would  mean  that  approximately  20 
out  of  a  fleet  of  2000  airplanes  would  bo  expected  to  fail  structurally'.  If 
the  20  failure#  all  occurred  at  gross  operational  overloads  approaching  150 
percent  of  the  operational  limitation,  the  result  would  be  tolerable.  On  the 
other  hand,  if  half  of  the  failures  occurred  within  the  operational  limitations 
as  defined  by  V-n  diagrams  and  the  other  half  occurred  beyond  in  the  overload 
range,  it  is  extremely  dubious  that  the  10  failuros  within  the  permissible 
operational  range  would  ever  be  tolerated.  This  would  be  true  even  though 
the  20  total  failures  would  be  no  greater  than  in  the  first  case.  The  pilots 
or  users  of  the  vehicle  would  soon  have  no  confidence  in  the  structural 
integrity  of  a  vehicle  that  failed  where  it  was  presumably  safo  and  permissible 
to  operate.  If  the  requirement  were  established  that  no  more  than  10  percent 
of  the  total  tolerable  number  of  failures  could  occur  at  limit  conditions  or 
less,  this  would  be  tantamount  to  saying  that  the  goal  is  no  more  than  two 
failures  at  less  than  limit  in  the  fleet  of  2000  vehicles.  Usually,  when  a 
second  failure  of  a  given  type  occurs,  it  is  considered  that  there  is  a 
problem.  Also,  there  are  bound  to  be  variations  from  the  goal  for  various 
reasons,  so  there  would  be  some  situations  where  3  or  4  failures  might  occur 
without  any  particular  indication  of  anything  being  wrong  in  the  structural 
design.  Therefore,  a  probability  of  failure  at  limit  or  lass  of  one  percent 
of  the  total  tolerable  number  of  failures  seems  to  be  quite  a  reasonable  goal. 


If  the  strength  scatter,  >'  ,  is  reasonably  low  and  if  the  factor  of 
safety  is  1.5  as  it  has  been  in  most  aerospace  systems  of  the  past,  there 
is  no  problem.  If  the  total  or  overall  structural  reliability  is  attained, 
the  one-percent  requirement  is  automatically  met.  It  is  very  likely  that 
this  is  the  reason  that  the  situation  has  never  been  recognized  as  a  problem 
in  the  past.  Figure  22  shows  a  typical  relationship  between  load  spectrum, 
strmgth  distribution  and  failure  distribution  for  two  typical  structural 
systems.  For  a  narrow-scatter  (y  =  0.05)  system,  essentially  all  the  failures 
occur  near  the  design  load  with  an  infinitesimal  portion  of  the  total  occurring 
below  limit  load.  The  omega  load  corresponds  io  the  load  at  the  omega  condi¬ 
tion  which  is  exceeded  in  one  in  ten-thousand  vehicles.  From  Figure  12  the 
omega  TFS  is  1.0.  Therefore,  the  design  load  to  which  the  "allowable"  strength 
is  matched  analytically  and  the  test  load  to  which  a  strength  test  is  conducted 
is  identical  to  the  omega  load.  The  strength  distribution  that  would  result 
if  there  were  no  error  in  ths  analysis  is  shown  by  the  solid  distribution  on 
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after  completion  of  the  strength  test  to  be  something  like  the  distribution 
of  Systems  A  through  T  on  Figure  10.  In  a  group  of  vehicles  such  as  these  most 
of  the  failures  will  occur  in  those  systems  whose  mean  strength  is  slightly 
lower  than  the  analytical  strength  distribution  yet  which  have  passed  the 
strength  test  and  been  accepted.  These  would  be  systems  like  G,  H,  I  and  P. 

The  failure  distribution  for  such  a  coaplex  of  structural  systems  would  be 
as  shown  on  Figure  22 . 


When  the  strength  scatter  is  large,  most  of  the  failures  will  occur  far 
below  that  design  load  which  will  result  in  the  acceptable  total  failure 
rate  (10~^  in  this  example).  Figure  22  shows  the  comparison  of  where  the 
failures  will  occur  for  the  large  and  small  scatter  systems.  It  is  apparent 
that  most  of  the  failures  in  the  large  scatter  system  have  bean  shifted  to  the 
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FIGURE  22.  EFFECT  OF  SCATTER  ON  FAILURE  DISTRIBUTION 


rang®  below  limit  condition  even  though  the  total  nuntoer  of  failures  satisfies 
the  SR  goal.  Aa  Just  diecueaed,  this  does  not  appear  to  be  a  satisfactory 
situation.  A  parametric  study  showing  the  fraction  of  the  total  failures  that 
will  occur  at  limit  condition  or  less  for  a  range  of  y9  is  shown  on  Figure  23. 

If  the  "one  percent"  requirement  is  adopted,  a  new  design  and  test 
requirement  can  be  established.  A  Test  Factor  of  Safety  for  limit  conditions, 
separate  and  distinct  from  the  one  established  on  Figure  12  for  omega  conditions, 
can  be  determined.  Its  development  would  be  comparable  to  that  discussed  in 
explaining  the  development  of  Figure  12.  The  computer  program  of  Volume  III 
is  utilized  to  calculate  the  factor  that  the  limit  loads  associated  with  each 
level  of  structural  reliability  (as  uefined  on  Table  I)  must  be  tested  to  in 
order  to  assure  that  the  probability  of  failure  at,  limit  condition  or  less 
will  be  no  more  than  one  percent  of  the  total  acceptable  probability  of  failure. 

PR  =  0.01  (1  -  S.R.)  (6) 

LIN 

Tne  necessary  factor  is  shown  on  Figure  24.  The  Limit  Design  Load  is  equal  to 
the  Limit  Test  Load  which  equal  the  Limit  Load  multiplied  by  the  Limit  TFS. 

Oi  Figure  24  it  is  significant  that  the  typical  1.5  F.S.  suffices  to 
provide  the  desired  limit  S.R.  up  to  a  yg  «  0.06  for  the  highest  S.R.  goal 

and  up  to  y#  a  0.10  for  the  lower  S.R.  goal.  The  type  of  structure  character¬ 
ized  by  a  =  0. 06  would  have  most  (99  percent)  of  its  strength  scatter 
between  a  range  of  +  14  percent  of  the  mean  strength.  It  is  dubious  if  very 
many  of  the  aircraft  structures  that  have  been  fabricated  in  years  past  have 
this  large  a  scatter.  Remember  that  this  represents  the  scatter  of  nominally 
identical  structures.  It  does  not  represent  the  strength  range  between  an 
underdesigned  structure  and  the  redesigned  structure  that  is  produced  at  a 
later  time. 

Since  most  of  the  acceptable  structural  systems  of  the  past  undoubtedly 
fell  below  these  bounds,  very  few  failures  occurred  below  Unit  condition  in 
properly  designed  and  fabricated  structures.  When  failures  did  occur  at 
limit  or  lower,  there  was  almost  always  some  form  of  gross  error  in  the 
structure  so  large  that  the  factor  of  safety  was  not  expected  to  provide  for 
it.  Thus,  no  special  effort  was  needed  to  provide  for  thi3  type  of  structural 
reliability  in  the  past. 

In  Section  2.3d(3)  the  increment  in  S.R.  due  to  multiple  strength  tests 
was  described.  This  resulted  in  a  decrease  in  the  Omega  TFS  as  shown  on 
Figure  20.  A  similar  decrease  in  Limit  TFS  results  if  two  or  more  strength 
tests  are  conducted.  The  required  Lindt  TFS  is  shown  on  Figure  25* 

(5)  Conditional  Reliability  after  Testing 

The  proposed  procedure  to  this  point  has  been  directed  towards  obtaining 
a  structural  system  with  a  conditional  structural  reliability  conmensurate 
with  the  total  S.R.  desired.  This  conditional  reliability  is  an  intrinsic 
characteristic  of  the  structure  itself.  It  does  not  depend  on  parameters 
such  aa  the  accuracy  of  the  loadB  analysis  or  the  proper  operation  of  the 


-  49  - 


Weibtll  Load  and  Strength  Distribmtiont 
S.  R.  Goal  -  .9999 
FS  -  1.5 


Halt  Design  Loud  =  Halt  Taut  Load  ”  Unit  Load  z  Linit  TPS 


Limit  Design  Load  =  Lindt  Test  Load  *=  Limit  Load  i  Limit  TFS 


'•S'-f! 


vehicle.  There  is  no  question  but  that  the  total  structural  reliabi Jlty  of 
the  vehicle  is  critically  dependent  on  the  correctness  of  these  other 
parameters.  If  the  choice  of  limit  and  omega  conditions  happened  to  be  very 
conservative,  the  total  structural  reliability  would  be  very  high.  On  the 
other  hand,  if  the  omega  condition  happened  to  be  exceeded  on  every  vehicle, 
the  total  S.R.  would  approach  zero.  But  the  conditional  reliability  of  the 
structure  for  the  conditions  and  loads  initially  defined  is  immutable.  Thus, 
it  can  be  specified  and  administered  separately  from  other  considerations 
that  affect  the  total  S.R. 

These  other  coneiderations  are  not  controllable  as  part  of  the  structural 
design,  per  se.  Therefore,  they  shoulo  be  identified  and  specified  separately 
from  the  requirements  for  the  structure  itself.  This  is  not  to  say  that  the 
conditions  for  which  the  conditional  reliability  has  been  established  cannot 
be  changed  if  subsequent  developments  show  the  conditions  to  be  inadequate. 
Such  a  change  in  required  conditions  for  the  structure  may  impose  a  require¬ 
ment  for  a  change  in  the  structural  design.  This  requires  an  agreement  to 
change  the  structure  but  does  not  indicate  there  is  anything  wrong  with  the 
structure  for  the  conditions  as  postulated  initially.  In  summary,  the 
decision  that  the  structure  is  acceptable  for  a  prescribed  loading  can  be 
isolated  from  the  decision  that  the  prescribed  loading  conditions  are 
acceptable  for  the  particular  vehicle  system. 

e.  Loads  Error  Disclosure  by  Testing 

The  previous  ssction  discussed  how  the  conditional  reliability  of  the 
structural  system  is  upgraded  by  disclosing  analytical  errors  that  may  occur 
in  the  strength  analysis.  This  first  conditional  reliability  is  based  on 
the  correct  determination  of  the  loads  associated  with  the  limit  and  omega 
conditions  and  on  the  correct  choice  of  the  limit  and  omega  conditions. 

Both  of  these  functions  are  subject  to  analytical  errors  comparable  to  those 
already  described  for  the  strength  analysis.  The  loads  ("loads"  includes 
local  forces,  aeroelastic  effects,  temperature,  acceleration,  etc.)  error 
function  has  not  been  documented  as  has  the  strength  error  function  in 
Reference  6.  Therefore,  the  computer  program  of  Volume  III  does  not  include 
a  loads  error  function  comparable  to  the  strength  error  function  discussed  in 
Section  2.3c.  However,  it  is  well  known  that  measured  flight  loads  often 
differ  significantly  from  the  analytically  predicted  values.  For  the  present 
a  decision  can  be  made  concerning  the  effect,  of  the  loads  error  on  the 
conditional  reliability  given  that  the  limit  and  omega  conditions  are 
properly  chosen  and  that  the  structure  has  been  properly  designed  and  tested. 
It  is  estimated  that  the  true  structural  reliability  of  a  system  whose  loads 
are  based  on  analysis  alone  will  be  reduced  from  the  predicted  value  to 
approximately  0.9,  comparable  to  the  reduction  shown  on  Figures  6  and  7  for 
strength  errors.  It  is  considered  that  the  accuracy  of  measuring  loads  is 
high  enough  compared  to  the  accuracy  of  the  statistical  parameters  so  that 
the  conditional  reliability  for  any  condition  where  loads  can  be  measured  is 
not  significantly  affected  by  measurement  errors.  In  other  words,  after  a 
flight  loads  measurement  program,  the  scatter  in  the  measured  value  about  the 
true  value  is  negligible.  Loads  measurements  up  to  ths  limit  conditions 
would  be  no  different  than  in  the  Present  System. 
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Verification  of  loads  beyond  limit  conditions  will  pose  many  obvious 
problems.  Manned  vehicles  will  normally  not  be  cleared  for  flight  beyond 
the  limit  condition,  which  usually  represents  an  operational  limitation. 
Therefore,  the  verification  of  the  omega  loads  corresponding  to  a  specific 
omega  condition  mist  bs  accomplished  in  whatever  manner  poeaible.  There  are 
s  number  of  possible  procedures  that  will  perform  the  verification  task  at 
least  passably  well.  For  example,  the  simpler  (linear)  extrapolation  of 
loads  measured  up  to  limit  condition  obviously  provides  an  approximation  of 
loads  beyond  limit.  If  there  are  differences  between  the  original  calcula¬ 
tions  and  the  extrapolation  of  the  measured  values,  there  muet  be  a  valid 
explanation  of  the  difference  or  tl e  original  calculations  must  be  considered 
questionable.  Often,  there  are  data  available  from  wind-tunnel  tests  con¬ 
ducted  to  conditions  corresponding  to  the  omega  condition.  If  the  wind-tunnel 
data  Is  validated  by  the  flight-test  data  up  to  limit  conditions,  then  it  is 
certainly  reasonable  to  conclude  that  the  wind-tunnel  data  beyond  limit  is 
not  wrong.  In  any  event,  a  decision  must  be  made.  As  noted  on  page  5  ,  the 
making  of  decisions  Is  a  key  element  in  any  structural  design  procedure.  It 
ahould  be  noted  that  difficulty  in  making  a  decision  cannot  invalidate  the 
need  to  make  the  decision.  The  problem  of  how  much  capability  beyond  limit 
conditions  needs  to  be  provided  has  always  been  present,  but  has  besn  sub¬ 
merged  in  the  procedures  of  the  present  system  by  an  implicit  decision  that 
whatever  operational  capability  happens  to  result  from  ths  procedure,  be  it 
large  or  small,  will  be  acceptable  if  it  results  from  the  application  of  the 
factor  of  safety  to  limit  leads.  It  was  pointed  out  in  Section  2.2  that  a 
single  factor  of  eafety  may  result  in  grossly  different  structural  performance 
capabilities  for  two  different  vehicle  designs  even  though  both  are  designed  to 
the  same  SDC.  This  is  due  to  the  varying  amount  of  operational  overload  capa¬ 
bility  that  results  if  the  loads  are  non-linear  with  respect  to  the  operating 
conditions.  It  must  be  recognised  that  active  consideration  of  a  difficult 
problem  will  be  more  likely  to  result  in  a  correct  decision  than  if  the  problem 
is  ignored  and  the  decieion  made  by  default.  In  this  case  the  correct 
decision  will  provide  the  same  overload  capability  for  all  vehicles  in  the 
same  operational  conditions. 

f.  Disclosure  of  Error  ir.  Design  Conditions 

It  was  pointed  out  previously  that  the  actual  reliability  of  a  structural 
system  is  critically  dependent  on  the  probability  of  exceeding  the  omega 
condition.  The  strength  may  be  exactly  as  desired  and  the  loads  for  a  given 
omega  condition  may  be  very  precise,  yet  the  structural  reliability  may  be 
far  lees  than  the  desired  value  if  the  frequency  of  exceeding  the  omega  con¬ 
dition  is  such  greater  than  predicted.  Figure  2fe  shows  how  the  probability 
of  failure  varies  with  the  probability  of  exceeding  the  omega  load.  If  the 
structure  has  its  strength  exactly  as  intended  with  the  allowable  (tne  99- 
percent-exceed  value)  exactly  at  the  omega  load,  probability  of  failure 
decreases  almost  exactly  in  proportion  to  the  decrease  in  the  probability  of 
exceeding  the  omega  load.  Thus,  there  is  an  almost  one-to-one  correlation 
between  the  frequency  of  exceeding  the  omega  condition  and  the  frequency  of 
failure.  Figure  26  shows  also  that,  no  matter  what  the  loading  spectrum,  the 
failures  that  do  occur  will  occur  very  elose  to  the  omega  condition  when  the 
atrength  scatter  is  relatively  low. 


The  actual  structural  reliability  attained  in  operations  corresponds 
(to  a  first  approximation)  to  the  conplement  of  the  probability  of  exceeding 
the  omega  condition  Since  Pg^is  controlled  by  vehicle  operational 

results,  this  naans  that  the  true  S.R.  is  al-iaost  completely  determined  by  a 
function  over  which  structural  organizations  have  no  direct  control.  This 
servos  to  explain  the  eiq>haais,  as  the  philosophy  of  the  proposed  procedure 
develops,  on  establishing  interface  requirements  with  non- structural  systems 
and  on  provisions  to  enforce  these  requirements.  The  point  is  made  also  that 
quantitative  structural  design  criteria  by  statistical  methods  cannot  ba 
established  unless  consideration  is  given  to  operational  conditions  beyond 
specified  limit  conditions. 

The  disclosure  of  any  error  in  the  selection  of  the  design  conditions, 
particularly  the  omega  condition,  cannot  be  accomplished  directly.  For 
instance,  if  the  predicted  value  of  Pg^ls  0.0001,  the  actual  value  could  be 

two  orders  of  magnitude  higher  yet  only  one  in  a  hundred  vehicles  would 
exceed  the  omega  condition  during  the  entire  lifetime  of  the  fleet.  The 
chances  of  an  exceedance  early  in  the  fleet  life  would  be  even  less.  If  one 
single  exceedance  did  occur,  it  would  be  difficult  just  from  this  single 
situation  to  decide  whether  there  is  an  error  in  the  prediction  of  Pg 

or  whether  the  exceedance  is  one  of  the  rare  random  exceedances  that  are  to  be 
expected. 

What  can  be  done  is  tc  compare  whatever  actual  results  are  available 
with  the  predicted  results.  A  few  hours  of  flight  experience  that  corresponds 
to  the  predicted  values  or  less  is  not  sufficient  to  "prove"  that  the  predicted 
values  are  a  satisfactory  approximation  of  tht*  lifetime  values  of  a  fleet  of 
vehicles.  But  a  relatively  few  hours  of  flight  experience  at  a  level  sig¬ 
nificantly  higher  than  the  predicted  values  nay  be  sufficient  to  decide  that 
the  predictions  are  wrong. 

Figure  2?  illustrates  how  such  decisions  can  be  made.  The  load  factor 
spectrum  that  was  predicted  when  the  limit  and  omega  conditions  were  chosen 
is  shown.  This  represents  the  spectrum  for  the  vehicle  expected  to  operate 
for  a  lifetime  of  20,000  hours.  If  the  data  on  hand  represents  200  hours  of 

actual  operations,  the  ejected  spectrum  should  have  &s  many  occurrences 
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at  each  load  factor  level  as  shown  on  Figure  27.  If  the  actual  200  hour 
spectrum  (Curve  1)  were  no  more  than  three  times  (one-half  order  of  magnitude) 
more  severe  than  expected,  there  would  be  no  concern.  This  variation  would 
be  considered  to  be  in  the  expected  range  of  variation  at  200  hours.  Cn  the 
other  hand,  if  the  actual  200-hour  spectrum  (Curve  2)  were  1000  times  (three 
orders  of  magnitude)  more  severe  than  expected,  it  could  be  decided  immediately 
that  there  Was  an  error  in  the  20000-h-ur  prediction.  Note  that  this  decision 
could  be  made  from  the  available  statistics  after  only  one  percent  of  tie 
life  shown,  without  the  limit  or  the  omega  conditions  being  exceeded.  Yet 
the  decision  that  an  error  had  been  disclosed  would  be  made  by  almost  all 
concerned  when  the  data  makes  the  situation  so  obvious. 
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In  ft  similar  ▼•in,  it  would  be  d«cld«d  that  there  waa  something  wrong 
with  a  landing  impact  velocity  spectrum  if  the  velocity  that  was  predicted 
to  ocour  once  in  *  million  landings  occurred  on  the  first  landing. 

Deciding  that  an  error  exists  does  not  prove  that  the  error  exists. 

However,  a  sound  engineering  decision  can  be  made  on  the  basis  Just  described. 
Therefore,  the  error-disclosure  procedure  can  be  based  on  a  formalized  decision¬ 
making  mechanism  using  this  basic  approach.  This  approach  was  Initially 
described  in  Reference  10.  A  more  sophisticated  version  of  the  procedure  has 
bean  Incorporated  in  a  otudy  performed  under  the  Reference  13  contract,.  In 
this  manner,  deterministic  decisions  can  be  made  ae  to  the  acceptability  of 
the  specified  limit  and  omega  conditions. 

g.  Proof  of  Compliance 

In  the  evaluation  of  the  Present  (Factor  of  Safety)  Structural  Design 
System  in  Volume  I,  the  need  for  a  proof  of  compliance  procedure  was 
emphasized.  It  was  pointed  out  that  a  contract  to  produce  a  structural 
system  under  the  Present  System  is  administrabie  because  the  established 
proof-of-conpliance  procedures  can  resolve  any  disagreements.  The  evaluation 
of  Volume  I  also  stated  that  the  principal  deterrent  to  the  adoption  of  a 
Purely  Statistical  Structural  Reliability  System  is  the  lack  of  a  proof  of 
compliance  technique.  Therefore,  it  is  considered  mandatory  that  any  new 
structural  design  procedure  must  be  cast  in  euch  a  form  that  explicit  means 
are  designated  to  prove  compliance  with  the  requirements  of  the  SDC. 

The  proof  of  compliance  procedure  in  the  proposed  method  is  essentially 
the  error  disclosure  technique  Just  discussed.  If  a  structural  system  is 
analyzed  first  and  then  tested  to  disclose  errors  in  the  analysis,  the 
structural  system  has  proved  its  compliance  with  the  requirements  when  the 
prescribed  tests  are  completed  satisfactorily  with  no  errors  being  disclosed. 
Therefore,  the  proof  of  compliance  consists  of  the  application  of  the  error- 
disclosing  procedures  Just  described  for  the  strength  of  the  system,  the 
loads  on  the  system,  and  the  basic  choice  of  the  design  conditions.  These 
will  be  discussed  in  the  same  sequence  normally  followed  in  proving  that  a 
structural  system  complies  with  the  requirements  of  the  SDC. 

(1)  Strength 

Proof  that  a  structural  system  complies  with  the  strength  requirements 
is  handled  typically  in  three  separate  and  distinct  phases.  First,  th6 
basic  design  is  qualified  and  approved.  Tests  such  as  the  conventional 
static  tests,  drop  tests  and  fatigue  tests  are  exai^ples  of  design  qualifica¬ 
tion.  Second  are  acceptance  tests  and  procedurss  for  the  individual 
structure.  Proof  tests  are  the  obvious  example  of  an  acceptance  test.  Most 
individual  vehicles  are  accepted  on  the  basis  of  the  usual  quality  control 
procedures  without  a  proof  test.  Nevertheless,  compliance  with  the  specified 
quality  control  procedure  corresponds  to  an  acceptance  test.  Finally,  there 
is  always  ft  form  of  proof  cf  compliance  during  the  operational  life.  This 
varies  from  a  simple  pre- flight  check  to  overhaul  and  inspections.  These 
all  have  as  an  objective  the  capability  to  certify  or  prove  that  the  opera¬ 
tional  vehicle  had  sufficient  structural  integrity  initially  and  has  retained 
this  structural  integrity  during  the  life  of  the  vehicle. 


-  58  - 


The  first  phase,  qualifying  the  basic  design,  should  be  handled  ir>  two 
parts.  The  first  is  te  prove  that  the  structural  system  will  rarely,  if  ever, 
fail  at  the  specified  limit  conditions.  The  second  part,  is  to  prove  that  tlu 
structure  has  a  capability  to  survive  designated  overload  conditions  beyond 
the  specified  limit  conditions.  The  test  loads  for  the  first  part  of  the 
proof  of  compliance  for  strength  are  defined  as  the  loads  corresponding  to 
the  specified  limit  condition  multiplied  by  the  limit  test  factor  of  safety 
determined  from  Figures  24  or  25.  The  effective  purpose  of  this  half  of  the 
requirement  is  the  assurance  that  the  structure  will  "never"  fail  at  the 
limit  conditions  which  by  definition  are  perraisoible  conditions.  As  a  result 
of  designing  and  testing  the  structural  system  to  loads  that  are  higher  than 
the  lindt  loads,  by  the  factor  indicated  on  Figures  24  or  25,  it  can  be  con¬ 
cluded  that  a  random  failure  at  the  limit  level  or  less  will  be  suitably 
rare  in  proportion  to  the  desired  structural  reliability.  Furthermore,  if 
a  failure  ever  does  occur  at  the  limit  condition,  a  discrete  cause  will  have 
to  be  evident  in  terms  of  non-compliance  with  specific,  deterministic  require¬ 
ments  so  that  responsibility  for  the  failure  can  be  assessed  and  the  corrective 
action  will  be  obvious.  Thus,  the  conclusion  is  appropriate  that  a  structural 
system  will  never  fail  at  conditions  as  low  as  limit  conditions  unless  a  gross, 
identifiable  error  has  occurred  in  the  fabrication  or  maintenance  of  the 
structure.  The  magnitude  of  ths  error  that  would  cause  a  failure  at  limit 
condition  or  less  is  so  grsat  that  it  can  be,  and  effectively  han  been  by 
Figures  24  and  25,  concluded  that  it  is  not  feasible  nor  desirabls  to  expect 
that  the  structure  should  tolerate  and  absorb  such  gross  errors.  Instead 
there  is  affectively  a  predetermination  that  it  is  feasible  to  fabricate  and 
maintain  the  structure  so  that  with  reasonable  care,  considering  ths  state 
of  the  art,  such  gross  errors  will  not  occur.  The  analytical  computations 
leading  to  choice  of  the  factors  on  Figures  24  and  25  are  a  prediction  that 
the  gross  understrength  represented  by  the  difference  between  the  test  condi¬ 
tions  and  the  limit  conditions  will  not  occur  more  oft an  than  established 
by  Table  I.  But  having  once  bean  made,  the  predictions  can  never  be  verified 
or  proved.  What  can  be  done  is  to  make  decisions  based  on  these  predictions 
that  a  failure  at  a  given  level  (l/UMIT  TFS)  below  the  value  established  for 
design  and  test  is  not  a  structural  responsibility  but  a  fabrication  or 
maintenance  responsibility.  Finally,  even  if  enough  statistical  data  is  not 
available  to  perform  the  statistical  conputation  accurately,  the  decision  of 
what  constitutes  a  gross  error  can  be  mads  with  wliataver  information  is 
available.  Since  no  failures  at  limit  or  less  axe  really  acceptable,  there 
must  be  an  expectation  ti'at  such  gross  errors  resulting  ir.  an  understrength 
can  be  prevented.  The  procedure  should  make  eocplicit  provision  for  defining 
how  it  is  feasible  to  avoid  the  gross  errors  that  will  cause  a  failure. 

If  the  feasibility  of  such  avoidance  cannot  be  documented  and  accepted 
by  those  responeible  for  such  avoidance,  then  it  does  not  appear  Justified 
to  design  and  test  the  structural  system  to  the  level  indicated  by  Figures 
24  and  25.  If  this  feasibility  to  avoid  the  gross  error  cannot  be  documented 
explicitly,  it  oust  be  considered  to  be  an  indirect  indication  that  the 

coefficient  of  strength  scatter,  Y  ,  used  to  determine  the  limit  TFS  on 

s 

Figures  24  or  25  oust  be  unconservative  and  should  be  revised  upwards. 
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The  first  requirement  provided  ext remedy  high  structural  integrity  for 
operational  conditicns  up  to  and  including  the  designated  limit  conditions 
because  these  conditions  are,  by  definition,  expected  conditions.  The 
purpose  of  the  second  requirement  is  to  provide  a  reasonable  capability  to 
survive  overload  conditions  beyond  the  designated  limit  conditions.  Capability 
is  needed  up  to  and  including  the  designated  omega  condition  but  no  capability 
ie  needed  beyond  omega.  It  was  explained  previously  that  this  capability  to 
survive  a  properly  defined  omega  condition  is  the  real  determinant  of  the 
total  probability  of  failure  and,  thua,  of  the  structural  reliability.  As 
noted  In  the  evaluation  of  the  Wagner  procedure  in  Volume  1,  the  concept  that 
the  structural  design  should  consider  omega  (or  ultimate)  conditions  is  a 
break  with  tne  past.  Some  of  the  ramifications  and  problems  associated  with 
such  an  approach  are  discussed  in  Section  VII. 

The  proof  of  conpliar.ce  that  the  structural  syst  em  will  survive  the 
omega  condition  and  that  the  total  probability  of  failure  corresponds  to  the 
acceptable  value  ie  furnished  in  two  steps.  First,  an  analysis  shews  that  the 
allowable  is  serial  to  cr  greater  than  the  omega  design  load  and  then  a  test 
demonstrates  taat  the  structure  can  survive  the  omega  design  load.  Theoe  two 
actions  constitute  proof  that  the  structural  system  has  the  desired  conditional 
reliability.  The  condition  for  the  reliability  is  that  the  omega  design  loads 
correspond  to  the  omega  condition  and  that  the  probability  of  occurrence  of 
the  omega  condition  ie  no  more  than  the  designated  v&lue. 

The  teat  loads  for  the  omega  test  are  defined  as  the  loads  corresponding 
to  the  specified  oi^sga  condition  multiplied  by  the  omega  tost  factor  of 
safety  determined  from  Figure  12.  It  should  be  noted  that,  if  the  temperature 
of  the  omega  condition  ie  higher  than  for  the  associated  limit  condition,  the 
test  would  be  conducts'!  at  the  omega  tanperaturea .  Also,  the  strength  scatter, 
ye,  might  be  larger  at  these  higher  omega  temperatures.  If  so,  the  larger 
value  should  be  used  in  determining  the  omega  TFS  rather  than  the  smaller  yB 
corresponding  to  the  limit  condition. 

sArvival  of  the  omega  test  loads  constitutes  proof  that  the  S.R.  will  be 
cloae  enough  to  the  desired  S.R.  to  be  satisfactory,  provided  that  the  omega 
condition  and  omega  loads  are  correct.  Proof  of  compliance  for  these  two 
parameters  must  await  the  beginning  of  actual  operations. 

Successful  cospletion  of  the  limit  and  omega  testa  represents  a  deter¬ 
ministic  requirement  that  is  quite  comparable  to  the  requirements  of  the 
Present  System.  Although  this  discussion  speaks  of  two  sets  of  teste,  limit 
and  omega,  in  many  oases  engineering  judgement  will  indicate  that  one  or  the 
other  is  much  more  critical  so  the  less  critical  test  will  not  be  nacessary. 
This  is  the  same  type  of  Judgement  currently  used  to  reduce  the  test,  operation 
to  a  dozen  or  so  of  the  most  critical  individual  cases  from  what  might  be 
hundreds  of  potentially  critical  cases. 

The  limit  and  omega  strength  tests  verify  or  prove  that  the  baeic  design 
is  satisfactory.  This  step  is  often  termed  design  qualification.  It  is  quite 
possible  that  'the  structural  system  of  an  individual  vehicle  from  a  properly 
qualified  design  may  be  deficient  for  any  of  a  number  of  reasons.  Typical 
would  be  a  sensitivity  to  cracks  1  welds  in  tension  or  bonding  difficulties 
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in  composite  structures.  There  are  various  forms  of  acceptance  testing  that 
constitute  proof  of  compliance  of  an  individual  structure.  A  proof  test  to 
some  small  increment  over  the  limit  load  might  be  very  effective  in  increasing 
th.>  structural  reliability.  This  would  be  particularly  true  where  loads  beyond 
limit  are  very  sharply  truncated  or  non-existent .  However,  where  the  load 
spectrum  is  quite  broad,  proof  tasting  may  provide  very  little  increase  in 
reliability.  For  Instance,  a  proof  test  to  105  percent  of  limit  will  help 
little  in  situations  where  the  structure  is  loaded  quite  regularly  to  125 
percent  of  limit.  In  the  future,  it  will  be  possible  to  use  the  Volume  III 
computer  program  to  determine  the  increment  in  S.R.  due  to  various  proof  or 
acceptance  test  procedures. 

After  the  structure  has  bsen  designed,  tested,  fabricated.' and  accepted 
by  proper  standards,  the  structure  as  it  exists  initially  may  be  considered 
to  possess  satisfactory  reliability.  Hcwever,  the  structural  strength  may 
decrease  during  the  operational  life  of  the  vehicle.  Procedures  should  be 
considered  on  how  to  prove  that  the  structural  strength  remains  sufficiently 
high.  Accidental  damage,  wear,  fatigue,  and  creep  contribute  tc  possible 
strength  decrements.  In  the  past,  ordinary  maintenance  care  and  visual 
inspections  were  sufficient  to  insure  and  prove  i,hat  the  structural  strength 
remained  sufficiently  high.  In  the  future,  as  time-dependent  strength  becomes 
more  important,  explicit  procedures  must  be  developed  to  serve  as  proof  that 
the  "now"  strength  of  a  structure  is  high  enough.  Some  discussion  of  the 
problem  is  presented  in  Section  2.4. 

(2)  Loads 

The  proof  of  compliance  procedure  to  show  that  the  loads  for  limit 
conditions  are  satisfactory  should  be  identical  with  present  practice.  As 
stated  previously,  it  is  considered  that  a  properly  conducted  flight  loads 
program  will  define  loads  close  enough  to  the  true  value  that  experimental 
error  need  not  be  considered  at  this  time.  However,  at  some  future  time  it 
will  be  desirable  to  add  provisions  to  consider  loads  measurement  errors  to 
the  computer  program.  This  may  be  especially  necessary  as  aircraft  ent  er  the 
hypersonic  speed  range  and  instrumentation  difficulties  increase. 

Proof  of  compliance  that  the  omega  loads  are  satisfactory  i3  one  of  the 
principal  problem  areas  in  implementing  the  proposed  procedure.  Some  of 
these  problems  were  discussed  in  Section  2.3».  At  present  it  is  considered 
that  proof  of  compliance  would  consist  of  the  analytical  determination  of  the 
omaga  loads  first.  In  questionable  or  non-linear  regions  the  analytical 
calculation  of  the  loads  for  specific  omega  conditions  should  be  supplemented 
by  wind-tunnel  teste.  The  proof  of  compliance  supplied  by  flight  test 
measurements  will  necessarily  be  indirect  and  incomplete.  Nevertheless,  it 
can  be  a  very  explicit  requirement.  For  instance,  the  measured  load  up  to 
the  vehicle  limitations  should  compare  very  closely  with  that  predicted 
analytically  and  from  wind-tunnel  results.  This  establishes  that  the  basic 
analytical  method  Is  correct  and  reduces  any  possible  error  to  the  range 
between  limit  and  omaga  conditions.  Furthermore,  it  is  possible  to  determine 
trends  such  as  the  variation  of  load  with  load  factor,  dynamic  pressure,  angle 
of  attack  and  Mach  number.  Cross  plots  and  eoctrapolation  of  these  trends  will 
be  sufficient  to  verify  the  omega  loads  in  most  cases. 


(3)  Design  Conditions 


Proof  of  compliance  procedures  for  the  design  conditions  cannot  begin 
until  operations  with  the  vehicle  actually  begin.  Proof  of  compliance  in  one 
form  or  another  actually  sh  old  continue  throughout  the  life  of  the  vehicle. 
The  first  formal  indication  or  proof  that  the  choice  of  design  conditions 
might  not  be  satisfactory  will  come  from  the  pilots  or  users  of  the  vehicle. 
If  the  vehicle  cannot  be  ©Derated  without  exceeding  the  operational  limita¬ 
tions  rather  frequently,  the  limit  condition  is  undoubtedly  too  low  and 
possibly  the  omega  condition,  as  well.  By  definition  the  limit  condition 
should  be  one  that  ie  rarely  exceeded  during  the  lifetime  of  the  vehicle. 
Hence,  if  it  has  been  exceeded  a  number  of  times  during  the  early  life  of 
the  vehicle,  a  decieion  can  be  made  that  limit  condition  haa  been  exceeded 
too  often.  How  often  ie  "too  often"  can  be  decided  by  procedures  ouch  as 
described  in  Section  2.3f. 

In  addition  to  the  simple  reporting  of  exceedances  of  the  operational 
limitations,  the  proof  that  the  design  conditions  were  chosen  properly  for 
the  actual  vehicle  operational  conditions  can  be  obtained  from  any  of  various 
forms  of  flight  recorders.  Eight-channel  recorders,  VG  or  VGH  recorders, 
and  statistical  counters  can  be  used  to  verify  the  design  conditions.  If 
the  number  of  exceedances  of  a  given  parameter  is  higner  than  some  value, 
predetermined  by  methods  described  in  Section  2.3f,  it  can  be  decided  that 
the  design  conditions  are  not  compatible  with  the  operations.  The  procedure 
developed  under  the  Reference  13  contract  will  analyze  operational  data  and 
print  warnings  if  the  operational  usage  is  more  severe  than  it  should  be. 

If  the  decision  is  made  that  the  design  conditions  are  being  exceeded 
too  frequently,  three  courses  of  action  are  available.  First,  the  vehicle 
user  can  be  informed  that  the  usage  of  the  vehicle  is  exceeding  (or  poten¬ 
tially  exceeding)  the  intended  usage  for  which  the  vehicle  was  designed. 
Changes  in  operations  can  correct  the  situation  before  any  failure  actually 
takes  place.  Second,  the  user  can  decide  that  the  current  vehicle  usage  is 
necessary  and  will  be  continued  in  the  future.  In  this  case,  it  would  be 
necessary  to  establish  new  design  conditions  and  redesign  the  structural 
system  accordingly.  The  third  alternative  is  to  decide  to  continue  the  more 
severe  operational  ueage  without  change  and  without  redesign.  In  this  case 
the  structural  reliability  that  was  originally  selscted  as  the  goal  will  not 
be  attained.  The  program  from  Volume  III  can  be  used  to  recompute  a  new 
S.R.  associated  with  the  actual  data  on  operational  usage.  The  user  can  be 
Informed  ae  to  the  failure  rate  that  can  be  expected  if  the  operations 
continue  to  be  as  severe  in  the  future. 

h.  Determination  of  Cause  of  Operational  Failure 

In  case  there  is  ever  a  failure  in  the  structural  system  during  vehicle 
operation,  the  determination  of  the  cause  will  be  very  comparable  to  the 
procedure  in  the  Present  System  as  described  in  Volume  I.  If  the  accident 
investigation  can  establish  that  the  failure  occurred  at  lees  than  tne  limit 
condition,  the  deoision  can  be  made  witnout  equivocation  that  the  cause  of 
the  failure  ie  a  deficiency  or  error  somewhere  in  the  structural  system.  If 
the  failure  occurred  when  the  vehicle  was  operating  at  or  beyond  the  omega 
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condition,  the  structural  system  can  have  no  responsibility  since  it  has 
completely  complied  with  its  requirements.  The  accident  mast  be  considered, 
to  be  the  result  of  overloading  the  vehicle  to  grossly  more  severe  conditions 
than  established  ae  permissible  in  the  operational  limitations. 

Although  the  causes  of  the  structural  failure  will  not  be  quite  so  clear- 
cut  if  the  failure  occurs  somewhere  between  limit  and  omega  conditions,  a 
decision  as  to  the  "cause"  can  be  made.  First,  the  structure  must  have  a 
discrepancy  present  ranging  from  a  minor  to  a  major  error.  It  wa8  intended 
in  the  design  of  the  structural  system  that  99  out  of  100  (or  a  similar 
number)  of  the  operational  vehicles  should  survive  up  to  the  omega  condition. 
Therefore,  when  a  failure  does  occur  at  less  than  the  omega  condition,  it  is 
far  more  likely  that  the  failure  results  from  an  error  in  the  structural 
system  than  from  a  random  low  strength  in  a  structure  properly  designed, 
tested,  fabricated  and  maintained.  Therefore,  a  decision  can  be  cade  that 
a  structural  deficiency  is  at  least  a  contributing  cause  to  any  failure 
between  limit  and  omega  conditions. 

On  the  other  hand,  any  operation  of  any  amount  beyond  the  limit  condi¬ 
tions  aa  specified  in  operational  limitations  is  impermissible.  Therefore, 
if  a  failure  occurs  anywhere  between  limit  and  omega  conditions,  the  user 
oust  be  considered  to  have  contributed  to  the  failure  by  overloading  beyond 

the  permissible  limits. 

Aa  a  result  of  this  capability  to  determine  a  causa  of  failure, 
responsibility  for  causing  the  failure  can  be  assessed  and  the  corrective 
action  necessary  to  prevent  a  repetition  of  the  failure  can  be  determined. 

This  can  be  done  because  both  the  design  and  operational  requirements  are 
associated  with  deterministic  limit  and  omega  conditions  even  though  the 
original  choice  of  the  conditions  was  based  on  statistical  considerations. 

2.4  TIME-DEPENDENT  (FATIGUE)  STRENGTH  SITUATIONS 

a.  Basic  Structural  Reliability  Considerations  in  Fatigue 

The  discussion  in  Section  2.3  dealt  with  what  is  commonly  called  the 
static  situation.  The  loads  may  actually  be  dynamic  in  nature  as  in  gust  or 
landing  situations  but  failure  is  caused  by  a  single  application  of  a  large 
load.  An  implied  corollary  of  static  design  is  that  the  structural  strength 
is  a  time-invariant  function.  If  the  strength  does  not  change  during  the 
vehicle's  lifetime,  the  failure  is  dependent  only  on  whether  the  specific 
failing  strength  is  exceeded  at  any  time  during  the  life  of  the  vehicle. 

In  many  structural  systems  the  strength  is  a  time-dependent  function.  Fatigue 
represents  the  obvious  time- dependent  situation  but  hot  structure  and 
corrosion  effects  also  involve  time-dependent  functions.  The  present  study 
is  based  upon  fatigue  considerations  but  the  philosophy  developed  for  this 
type  of  structural  environment  is  universal  in  its  application  to  any  time- 
dependent  strength  problem. 

The  approach  used  in  developing  the  proposed  new  structural  design 
criteria  for  fatiguo  situations  involves  fundamentally  different  considera¬ 
tions  from  those  used  in  most  other  fatigue  analysis  procedures.  The 
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principal  difference  Is  use  of  the  concept  of  reBidual  strength  as  the 
significant  fatigue  parameter  rather  than  life.  "Life"  is  not  a  physically 
meaningful  concept  in  fatigue  analysis.  As  stated  in  Reference  11,  "Fatigue 
failure  is,  in  essence,  an  ultimata  load  failure,  but  one  Involving  a  fatigue- 
damaged  structure,  and  therefore,  occurring  under  a  terminal  load  of  consider¬ 
ably  lewer  intensity."  No  structure  ever  failed  mechanically  simply  because 
It  exceeded  some  number  of  hours  of  operation.  If  low  loads  were  being 
experienced  when  the  "life"  was  exceeded,  as  in  a  navigational  training 
flight  in  an  airplane,  the  structure  would  not  fail.  When  a  high  load 
immediately  before  or  immediately  after  the  supposed  end  of  "life"  is 
experienced,  the  structure  will  fail.  Failure  must  always  be  the  result  of 
the  load  at  that  particular  instant  of  time  exceeding  the  strength  at  that 
particular  instant  of  time.  Just  as  the  initial  strength  in  a  group  of 
similar  structures  will  vary,  so  will  the  residual  strengths  of  these  same 
structures  vary  at  a  later  time  during  the  life  of  the  structure. 

The  probability  of  failure  of  a  structure  during  some  particular  period 
during  its  life  is  a  function  of  the  residual  strength  distribution  at  that 
particular  period  and  the  load  distribution  during  that  particular  period. 

This  is  analogous  to  the  definition  of  the  probability  of  failure  when  tbs 
strength  does  not  vary  during  the  lifetime  in  the  static  strength  situatJ  on. 
In  Section  2.2  of  Volume  III  this  probability  is  defined  as 

00 

Pp  =  y*PEL^xi^p25^xi^dxi 

0 


This  is  the  conventional  fornulation  of  the  probability  of  failure  except 
that  the  strength  density  function  (P25)  expanded  in  meaning  to  include 

a  probability  of  analytical  error  and  probability  of  test  disclosure  of  this 
error.  This  formula  is  the  basis  for  all  of  the  analyses  of  the  static  cases 
presented  in  the  previous  section.  This  same  formulation  is  used  in  the 
fatigue  analysis,  but  the  functions  are  time-dependent  for  fatigue.  If  it 
is  assumed  that  the  strength  distribution  is  constant  for  some  small  period 
of  tins,  At,  at  a  time  t,  the  formulation  for  the  probability  of  failure 
during  this  At  period  parallels  equation  (7). 


P F  (t,  At) 
a 


Ar)pRS(xi’  T)dxi 


(8) 


where 


t  =KAr 


(9) 


The  fora  of  equation  (8)  is  the  same  as  equation  (7).  The  period  for  which 
the  strength  distribution  in  ®quaiion  (7)  is  assumed  constant  is  for 

a  vehicle  lifetime,  such  as  5000  or  50,000  hours.  In  equation  (8),  the  strength 
distribution  (x^,  t  '  considered  to  be  constant  for  A  t  period,  but  it  is 

different  at  each  time,  r  ,  such  as  at  5,  i>0  or  500  hours.  In  the  same  vein. 
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P$  (xj_.  At)  i»  the  probability  that  the  load  will  exceed  during  a  short 
L 

time  period,  auch  as  2  or  200  hours,  whereas  Pg  (x^)  in  equation  (7)  is  the 

L 

probability  o f  exceeding  at  any  time  during  a  lifetime  period  auch  aa 
5000  to  50, OCX)  hours.  Equation  (8)  reduces  to  equation  (7)  if  is  a 
constant  for  any  time  t  and  if  At  equals  the  total  hours  in  the  vehicle 
lifetime. 

Equation  (8)  expresses  the  probability  of  failure  during  the  k-th  time 
period,  which  is  some  time  between  zero  time  and  the  specified  service  life, 
T.  Therefore,  the  total  probability  of  failure  at  time  T  can  be  written  aa 

J_ 

-  1  -  Pg(T)  _  1  ~  n  Pq  (t,At) 
k  =  l  SK 


X 

At 


1  -  n  ["i  -  pF(T>  At) 

, _ L  K  J 


k  =1 


X 

At 

i  -  n 

k  =1 


1  -  y*Pg  (xi#  At)prs(x1,  T>dx 
0 

(10) 


The  capability  to  evaluate  equation  (10)  is  critically  dependent  on  the 

ability  to  evaluate  the  reaidual  strength  function  p  .  However,  the 

iw 

difficulty  in  evaluation  does  not  detract  from  the  fact  that  the  fatigue 
probability  of  failure,  as  formulated  in  equations  (8),  (9),  and  (10),  is 
a  physically  satisfying  and  mathematically  sound  formulation  of  the  problem. 

rtieh  of  the  technical  effort  in  analyzing  fatigue  problems  has  been 
based  on  the  concept  of  fatigue  life.  Therefore,  there  is  not  extensive 
literature  available  on  the  determination  of  residual  strength.  Valluri, 
in  Reference  12,  presented  a  fatigue  analysis  that  is  adaptable  to  the 
needs  of  the  proposed  criteria  procedure.  The  details  of  the  adaptation 
of  Valluri' a  procedure  to  the  computer  program  used  to  solve  equation  (10) 
are  presented  in  Volume  111  of  this  report.  It  should  be  understood  the 
formulation  of  equation  (10)  is  not  dependent  on  the  particular  residual 
strength  functions  developed  in  Volume  III  from  the  theory  of  Reference. 

If  a  more  acourate  prediction  can  be  developed  or  if  experimental  data 
on  reaidual  strength  can  be  obtained,  the  program  presented  in  Volume  Ill 
will  change  in  detail  but  not  in  principle. 
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The  essence  of  the  Volume  III  adaptation  of  the  Reference  12  theory  is 
the  relaticnehip  between  the  Fatigue  Damage  Index  (FDI)  and  the  Residual 
Strength  (RS).  The  FDI  is  a  convenient  concept,  somewhat  analogous  to  the 
well  known  Miner's  Fraction.  This  analogy  is  developed  more  completely  in 
Volume  III.  However,  the  meaning  of  the  FDI  is  associated  with  RS  so  that 
the  greater  the  fatigue  damage,  as  indicated  by  the  FDI,  the  less  the 
residual  strength.  The  relationship  is  nonlinear  but  simple  to  determine. 
The  FDI  for  a  simple  case  of  constant  amplitude  loading  increases  linearly 
with  time  according  to  the  Volume  III  discussion.  The  relationship  between 
FDI  and  RS  ie  giver,  in  Volume  III  as 


FDI  =  log  (11) 

6  ^RS 

Thus,  a  typical  relationship  would  bs  as  shown  in  Figure  28.  It  is  indicated 
in  Volume  III  that  the  increase  of  the  FDI  will  be  approximately  linear 
when  a  random  loading  is  the  source  of  the  fatigue  damage.  Again,  this  is 
similar  to  the  growth  of  Miner's  Fraction  with  time.  Therefore,  in  ths 
development  of  the  proposed  procedure,  it  is  assumed  that  the  growth  of  the 
FDI  is  always  linear. 

b.  Rudimentary  System 

The  use  of  the  FDI/RS  relationship  in  structural  design  criteria  based 
on  etatietical  methods  can  beat  be  illustrated  by  a  simple  example.  The 
parametere  in  the  exanple  are  deliberately  chosen  to  produce  a  high  prob¬ 
ability  of  failure  so  the  numbers  will  bs  more  comprehensible  than  they 
would  be  with  the  very  low  values  usually  considered  in  etructural  relia¬ 
bility  problems. 

It  is  assumed  that  the  loading  spectrum  for  a  vehicle  with  a  nominal 
20,000-hour  service  life  ie  as  shown  on  Figure  29.  It  is  then  assumed  that 
the  structure  is  such  that  this  loading  spectrum  produces  the  fatigue  damage 
and  residual  strength  shown  on  Figure  28.  In  the  real  situation,  the  FDI 
would  be  computed  from  the  load  spectrum  and  knowledge  of  the  structure  as 
discussed  in  Volume  III.  A  more  realistic  example,  using  F-100  data,  is 
presented  in  Section  VI  of  this  report.  To  simplify  the  manual  calculation 
of  the  probability  of  failure,  the  RS  is  assumed  to  vary  in  steps  every 
ten  percent  of  the  20,000-nour  life,  or  in  2000-hour  increments  as  shown 
on  Figure  28.  A  2000-hour  load  spectrum  can  be  determined  from  the  20,000- 
hour  spectrum  as  shown  in  Figure  29,  assuming  that  the  2000-hour  spectrum 
has  l/iO  the  itunijer  of  exceedances  of  the  20 ,000- hour  spectrum.  From  this 
2000-hour  spectrum,  the  probability  of  exceeding  a  load  can  be  calculated 
uelng  the  conventional  Poisson  distribution. 

PE  (Xi)  -  1  -  e~N  (12) 

If 

This  probability  ie  also  shown  on  Figure  29«  Finally,  it  is  assumed  that 
all  structures  will  experience  identically  the  same  fatigue  damage  or  lose 
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in  residual  strength.  It  is  recognised  that  all  these  aseunptiona  over¬ 
simplify  the  problem,  but  they  serve  tha  purpose  of  illustrating  that  there 
is  no  single  time  that  can  bo  called  the  life  of  tho  structure.  The  assump¬ 
tions  will  be  expanded  and  Justified  later  in  the  discussion  after  the  basic 
approach  is  presented. 


Since  it  was  assumed  that  there  is  no  scatter  in  the  strength  of  the 
individual  systems,  equation  (8)  reduces  to  Pp  =  PE[RS(lt)j.  In  the  first 


2000-houi-  period,  the  value  of  the  average  residual  strength  from  Figure  28  is  96 
percent  of  the  initial  ultimate  strength.  From  Figure  29  the  probability 
of  exceeding  this  load  during  the  2000-hour  period  is  0.0018.  Thus,  the 
probability  of  survival  of  the  period  is  1  -  0.0018  or  0.9982.  During  the 
second  2000-hour  period,  the  strength  has  dropped  to  87  percent  and  the 
probability  of  exceeding  this  strength  has  increased  to  0.0063.  The 
probability  of  surviving  this  second  period  becomes  0.9937*  The  probability 
of  eurviving  both  the  firat  and  second  2000-hour  periodo  is  the  product  of 
0.9982  x  0.9937,  or  0.9919.  The  procedure  is  continued  for  as  many  periods 
as  desired.  Table  II  preeents  the  numerical  data  and  Figure  30  shows  the 
plot  of  the  probability  of  failure.  Figure  31  shows  the  same  data 
plotted  on  a  linear  scale  which  better  shows  the  time  span  where  failure 
might  bo  observed  in  operations.  Figure  31  also  shows  a  histogram  of  the 
percentage  of  structures  that  would  be  expected  to  fail  in  each  period. 

Typically,  if  10  to  100  structures  were  involved,  the  spread  in  life  about 
the  mean  would  be  approximately  two  to  one  as  shown. 


Another  phenomenon  that  can  be  illuminated  by  this  simplified  example 
is  the  difference  between  service  failures  and  test  failures.  If  the 
spectrum  shown  on  Figure  29  for  20,000  hours  is  used  for  the  fatigue  test, 
the  applied  spectrum  must  be  a  truncated  spectrum.  A  load  cannot  be 
applied  one-tenth  of  a  time  during  the  test  of  a  single  test  article. 
Therefore,  a  spectrum  such  as  shown  on  Figure  29  would  result  in  the  limit 
load  of  100  percent  being  applied  once  sometime  during  the  test.  No  higher 
load  would  be  applied. 

This  truncation  of  the  higher  loads  would  not  affect  the  fatigue  damage 
significantly  but  would  make  a  major  difference  on  when  the  structure  will 
fail  during  the  etatic  test  relative  to  the  failures  that  would  occur  in 
service.  Many  different  plana  for  determining  the  maximum  load  applied 
during  each  sub-period  are  reasonable.  The  shaded  lines  on  Figure  32  show 
one  such  plan  for  applying  lest  loads  that  is  consistent  with  tha  spectrum 
of  Figure  29  •  With  thie  particular  arrangement ,  the  test  load  in  each 
period  would  be  less  than  the  residual  strength  so  no  failure  would  occur 
until  the  55  percent  load  wae  applied  during  the  eighth  period.  Contrast 
this  with  a  significant  nmdber  of  failures  beginning  in  the  third  period 
of  the  service  operations  of  a  fleet  as  shown  on  Figure  31.  If  100 
vehicles  had  conpleted  30  percent  of  the  nominal  life.  Table  II  shows  that 
two  or  three  {2.6%)  of  the  vehicles  would  have  experienced  a  load  high 
enough  during  this  third  period  to  cause  a  fatigue  failure.  Yet  no  failure 
would  occur  during  the  test  until  the  eighth  period  or  80  percent  of  the 
nominal  life.  From  Figure  32  it  can  be  seen  that,  if  the  _  *±mum  test  load 
(67/0  happened  to  be  applied  during  the  fifth  period  inst<j»ad  of  during  the 
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Probability  of 
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Corresponding 
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Incremental 
Probability 
of  Survival 

Aps 

Cumulative 
Probability 
of  Survival 

ffPs 

Cumulative 
Probability 
of  Failure 

PF 

1  8t 

0.96 

.00183 

.9982 

.9982 

.0018 

2  nd 

0.87 

.0063 

.9937 

.9919 

.0081 

3  rd 

0.79 

.017 

.982 

.974 

.026 

4  th 

0.71 

.056 

.944 

.919 

.081 

5  th 

0.64 

.125 

.875 

.804 

.196 

6  th 

0.57 

.25 

.75 

.603 

.397 

7  th 

0.51 

.40 

.60 

.362 

.638 

8  th 

0.46 

.56 

•  44 

.159 

.841 

9  th 

0.4 2 

.67 

.33 

.052 

.948 

10  th 

1 

0.38 

.77 

.23 

.Oil 

.989 
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tenth  period,  test  failure  would  occur  during  the  fifth  period  instead  of 
the  eighth.  On  the  other  hand,  if  the  fatigue  damage  ware  slightly  less, 
the  failure  would  not  occur  in  the  fifth  period,  even  with  the  67  percent 
load  applied.  Then,  with  the  higher  RS,  no  failure  would  occur  until  after 
the  tenth  period. 

Thus,  without  considering  that  there  ie  any  variation  between  indivi¬ 
dual  structural  systems,  it  can  be  shown  that  a  test  failure  may  occur 
anywhere  between  9000  ana  20,000  hours.  In  the  example,  significant 
numbers  of  failures  would  occur  in  a  fleet  between  4000  and  6000  hours  and 
by  some  standards  as  early  as  2000  hours.  It  is  considered  that  this  wide 
discrepancy  between  time  of  test  failure  and  the  beginning  of  fleet  failures 
ie  a  gross  indication  of  why  moot  previous  fatigue  criteria  have  considered 
that  a  scatter  factor  ie  neceseary  to  relate  permissible  service  life  to  the 
fatigue  test  life.  It  must  be  emphasized  that  the  scatter  between  test  and 
service  failures  in  this  example  are  not  necessarily  realistic  since  the 
fatigue  damage  was  deliberately  assumed  very  large  to  help  illustrate  the 
considerations  essential  to  this  type  of  analysis. 

c.  System  with  Scatter  in  Residual  Strength  Considered 

The  first  refinement  of  the  Fatigue  Reliability  Program  (FATREL) 
described  in  Volume  III  beyond  the  simple  formulation  just  described  is 
the  introduction  of  the  effect  of  scatter  on  the  residual  strength.  Two 
additional  parameters  are  introduced  into  the  calculation  to  define  this 
scatter  as  a  function  of  time.  These  two  parameters  are  the  coefficient 
of  strength  scatter  at  time  zero,  70,  and  the  scatter  factor  on  fatigue 

life,  a.  7#  it  the  same  scatter  factor  discussed  in  Section  2.3*  The 
fatigue  scatter  factor,  s,  represents  the  range  in  hours  or  number  of 
cycles  to  failure  relative  to  the  mean  life.  This  factor  la  discussed 
further  In  Volume  III, 

When  these  two  scatter  parameters  are  added  to  the  previous  definition 
of  the  FDI,  or  residual  strength,  the  complete  lifetime  strength  distribu¬ 
tion  ie  defined.  This  is  shown  on  Figure  33 •  Points  (A)  and  (B)  define 
the  line  representing  the  mean  strength.  This  ie  the  same  FDI  line  shown 
on  Figure  28.  Point  (A)  represents  the  initial  mean  strength  at  time  zero. 
Actually,  thie  is  calculated  from  Point  (C)  which  represents  the  "allowable" 
strength,  knowing  7a,  In  the  exanple,  this  allowable  represents  the  99- 
percent-axceed  stress.  From  the  mean  stress  at  Point  (a),  the  one-percant- 
exceed  stress  (D)  is  calculated.  The  values  at  points  (A),  (C),  and  (D)  are 
inputs  to  ths  program  described  in  Volume  III. 

The  variation  in  the  residual  strength  distribution  with  time  is 
controlled  by  ths  fatigue  scatter  factor,  s.  Thie  factor  represents  the 
variability  in  time  (or  number  of  cycles)  when  nominally  identical 
structures  fail  under  constant  amplitude  loading.  There  are  data  in  the 
literature  showing  that  such  scatters  renge  at  least  over  the  range  of  2:1 
to  10:1.  It  should  be  understood  that  this  scatter  is  not  the  samo  scatter 
discussed  in  connection  with  Figure  31.  In  that  example,  there  wae  no 
scatter  in  the  strength  of  individual  structure.  The  decrement  in  the  KS 
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of  each  structure  was  assumed  to  be  identical  in  all  the  structures.  The 
scatter  in  the  time  of  failure  was  due  completely  to  the  randomness  cf  the 
application  of  loads  large  enough  to  exceed  the  R5  of  the  structure  to  which 
they  were  applied. 

If  the  scatter  in  time  of  failure  under  application  of  constant 
amplitude  loading  is  considered  to  be  a  known  parameter,  it  can  be  incor¬ 
porated  in  the  computation.  Furthermore,  it  is  considered  that  the  meaning 
of  a  scatter  factor  of  2.0  is  that  99  percent  of  the  structures  survive  at 
least  to  one-half  the  mean  time  to  failure  and  one  percent  survive  to  twice 
the  mean  time  to  failure.  It  is  assumed  that  this  scatter  in  life  is  appli¬ 
cable  when  the  residual  strength  corresponds  to  approximately  4.0  percent  of 
the  ultimate  tensile  strength.  This  residual  strength  corresponds  to  a 
FDI  =  1.0.  Accordingly,  points  (£)  and  (F)  on  Figure  33  can  be  located  on 
the  FDI  =  1.0  level  with  Point  (F.)  at  one-half  the  hours  for  Point  (B)  and 
with  Point  (E)  at  twice  the  hours.  The  three  lines  on  Figure  33  are  the 
basis  for  constructing  the  complete  RS  distribution.  Similar  lines  for  a 
given  probability  of  exceeding  the  strength  are  drawn  as  shown  on  Figure  34- 
The  calculations  for  each  of  these  lines  is  performed  automatically  in  the 
computer  program  described  in  Volume  III. 

With  the  residual  strength  distribution  established  for  a  given  time 
period  from  Figure  34  and  the  probability  of  exceeding  a  load  established 
as  on  Figure  29,  Equation  (8)  can  be  evaluated  for  each  time  period.  Then, 
the  cumulative  probability  of  failure  can  be  determined  by  evaluating 
Equation  (10).  The  FATRSL  program  described  in  Volume  III  performs  al  1  of 
these  calculations  automatically.  The  program  prints  out  the  incremental 
probability  of  failure  for  each  time  period  and  the  cumulative  value. 

d.  System  with  Errors  in  Fatigue  Analysis  Considered 

Up  to  this  point  in  the  development  of  the  philosophy  governing  the 
proposed  procedure  for  structural  design  criteria  for  fatigue  situations, 
it  has  been  assumed  that  the  strength  distribution,  p^,  was  ^Glown'  !-«-> 

that  there  were  no  errors  in  the  fatigue  analysis.  As  it  was  pointed  out  in 
Section  2.3c,  there  are  many  cases  where  the  actual  strength  of  a  structural 
system  is  different  from  that  predicted  by  analytical  calculations  made 
during  the  design  of  the  system.  Figure  5  presents  data  from  Reference  6 
documenting  the  incidence  of  such  discrepancies.  There  are  no  known  data 
available  to  compare  the  predicted  results  from  fatigue  analyses  with  the 
actual  results  from  tests.  The  fatigue  analysis  of  a  structure  is  a  more 
complex  problem  than  the  static  analysis  so  it  might  be  expected  that  the 
nuaiaer  of  discrepancies  would  be  greater.  It  is  well,  known  that  there  has 
been  a  considerable  incidence  of  premature  failures  during  fatigue  tests. 
Therefore,  it  must  be  considered  that  the  frequency  of  occurrence  of  such 
discrepancies,  or  errors,  in  the  analysis  is  not  infrequent. 

There  are  a  number  of  different  causes  for  errors  in  a  fatigue  analysis. 
However,  each  cause,  such  as  a  higher  stress  concentration  factor  (SCF)  than 
anticipated,  a  generally  higher  stress  level  or  a  material  more  sensitive 
to  fatigue,  would  result  in  a  higher  FDI.  This,  in  turn,  would  result  in  a 
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higher  probability  of  failure.  Figure  35  presents  a  plot  showing  the  higher 
Pf  that  results  from  a  higher  SCF.  Thus,  if  the  analyst  assumed  no  stress 
concentration,  he  would  predict  that  a  service  life  of  6800  hours  would 
result  in  the  desired  SR  of  0.99.  However,  if  a  4.0  SCF  happened  to  exist 
unbeknownst  to  the  analyst,  the  life  for  C.99  SR  would  be  about  one  third  as 
much  or  2300  hours.  If  a  series  of  structures  were  designed  with  the  inten¬ 
tion  that  there  be  no  stress  concentration  but  if  25  percent  of  the  designs 
had  an  unpredicted  4.0  SCF,  the  average  failure  rate  for  a  6800  hours  life 
over  a  group  of  such  designs  would  be  0.75  x  .01  +  0.25  x  0.99  *=  0.2550  instead 
of  the  0.01  that  follows  if  all  designs  are  as  predicted.  Almost  all  of  these 
failures  would  be  in  the  25  percent  that  have  the  high  probability  of  failure. 

This  is  very  analogous  to  the  situation  described  in  Section  2.3c  and  shown  on 
Figure  9.  There,  the  structural  designs  with  lower  than  predicted  mean  strengths 
contribute  the  most  to  the  total  failure  rate  of  all  the  systems  from  A  through  T. 

The  computer  program  described  in  Volume  Ill  has  the  capability  to  accept 
six  different  stress  concentration  factors  and  an  associated  occurrence 
density  figure  (corresponds  to  0.75  and  0.25  just  discussed).  This  is 
considered  sufficient  to  define  the  range  of  possible  discrepancies  in  actual 
fatigue  damage  relative  to  the  value  predicted  analytically. 

e.  Fatigue  Strength  Error  Disclosure  by  Testing 

In  Section  2.3d  it  was  pointed  out  that  one  strength  test  could  not 
"prove"  the  reliability  of  a  structure  but  that  one  test  could  disclose  errors 
in  the  analysis.  The  same  principles  apply  to  structural  design  when  fatigue 
is  a  major  consideration.  The  problem  in  the  fatigue  situation  is  that  a 
single  fatigue  test  does  not  have  the  same  certainty  of  disclosing  an  error 
as  has  a  single  static  test  of  a  structure  with  a  narrow  strength  scatter. 

An  example  of  the  difficulty  in  establishing  a  fatigue  test  that  will 
reveal  errors  in  the  fatigue  analysis  with  a  high  degree  of  certainty  can  be 
seen  by  examining  Figure  35-  Suppose  that  a  0.9999  SR  is  desired  at  a  service 
life  of  3000  hours.  If  the  structure  has  a  probability  of j failure  as 
represented  by  the  lower  curve  of  Figure  35,  the  Pp  of  10-**  at  3000  hour3 

will  correspond  to  0.9999,  as  desired.  However,  if  there  is  a  higher  than 
expected  SCF  (or  anything  else  that  increases  the  fatigue  damage)  as  might 
be  represented  by  the  higher  curve  on  Figure  35,  the  Pp  at  3000  hours  will  be 
4xl0~2.  This  is  2^  orders  of  magnitude  higher  than  the  desired  value.  If  a 
design  which  corresponds  to  this  upper  curve  is  tested  to  6000  hours  (twice 
the  number  of  hours  corresponding  to  the  nominal  service  life),  the  probability 
of  failure  is  0.95.  This  means  a  probability  of  0.05  that  the  "unreliable" 
design  will  successfully  pass  the  test  to  twice  the  nominal  life.  Accepting 
one  out  of  every  twenty  deficient  designs  would  not  be  tolerable  in  most 
cases.  The  power  of  the  fatigue  test  as  a  discloser  of  error  would  be  grossly 
inferior  to  that  provided  by  the  static  test  as  discussed  in  Section  2.3d. 

The  previous  paragraph  discussed  the  problem  of  the  relatively  high 
chance  of  accepting  structures  that  will  fail  mien  earlier  than  predicted. 

In  addition  to  this  problem  there  is  the  problem  that  the  test  spectrum  cannot 
represent  the  service  spectrum  exactly.  Any  load  that  has  a  frequency  of 
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occurrence  less  than  1.0  would  not  be  applied  during  the  fatigue  test,  yet 
these  loads  will  contribute  significantly  to  the  nunber  of  failures  during 
the  service  life  of  a  fleet  of  vehicles.  The  phenomenon  was  introduced  in 
the  discussion  of  a  Rudimentary  System  in  Section  2.4b.  Ch  the  other  hand, 
there  are  some  situations  where  the  fatigue  test  will  have  a  probability  of 
failure  higher  than  in  uhe  corresponding  fleet  operation.  This  can  be  under¬ 
stood  by  studying  Figure  36.  As  noted  above,  there  is  a  discrete  load  that 
is  encountered  once  in  the  average  lifetime.  Usually,  this  is  the  maximum 
load  applied  during  the  test.  In  this  situation,  there  is  a  probability  of 
1.0  of  exceeding  any  load  smaller  than  this  maximum  test  load  and  a  zero 
probability  of  exceeding  any  larger  load.  The  probability  of  an  individual 
vehicle  exceeding  this  value  is  less  than  1.0  (about  .63).  These  relation¬ 
ships  are  shown  on  Figure  36.  Thus,  the  test  operation  has  a  higher 
probability  than  the  fleet  operation  of  exceeding  all  loads  up  to  the  maximum 
test  load.  Beyond  that  point  the  fleet  operation  has  the  higher  probability. 
Which  is  controlling  in  determining  the  total  probability  depends  on  the 
strength  distribution.  Therefore,  it  is  really  not  possible  to  generalize, 
except  to  note  that  the  test  operation  will  almost  always  have  a  different  Pp 
than  the  fleet  operation.  All  of  these  considerations  must  be  recognized 
in  determining  tha  conditional  reliability  that  results  from  recognition  that 
there  nay  be  errors  in  the  fatigue  analysis  and  that  successful  completion  of 
a  particular  fatigue  test  does  not  necessarily  indicate  that  all  of  the  under¬ 
strength  designs  have  been  eliminated.  Figure  37  illustrates  the  difference 
between  the  probability  of  failure  in  fleet  operation  and  in  a  test  operation 
whose  spectrum  is  truncated  at  the  load  that  will  be  experienced  once  during 
the  service  life. 

The  fatigue  reliability  program  described  in  Volume  III  makes  provision 
for  all  of  the  phenomena  just  discussed.  Basically,  it  solves  Equation  (10). 
It  should  be  clearly  understood  that  the  analytical  procedure  recommended  in 
Section  2.4a  for  determining  the  residual  strength  is  not  considered  to  be  a 
panaceA  for  all  fatigue  problems.  However,  the  concept  developed  in 
Reference  12  and  its  expansion  to  the  Fatigue  Damage  Index  in  Volume  III  of 
this  report  have  the  necessary  elements  incorporated.  Intrinsically,  the 
procedure  is  solving  the  correct  probi em  and  the  answers  obtained  are 
qualitatively  correct.  The  point  was  nade  in  Section  2.3c  and  reiterated 
for  the  fatigue  problem  in  Section  2.4d  ohat  errors  will  occur  In  any 
structural  analysis.  It  matters  not  whether  the  error  is  generated  by  an 
erroneous  mathematical  model  of  the  failure  process  or  by  an  erroneous  choice 
of  quantities  to  represent  the  particular  structure  being  analyzed.  If  a  set 
of  curves  such  as  those  on  Figure  35  can  be  generated,  very  useful  conclusions 
can  be  developed  from  the  qualitative  relationships.  A  density  function 
number  can  be  assigned  to  each  condition  represented  (Example  2  in  Volume  III 
presents  a  four  condition  problem).  These  density  functions,  in  effect, 
represent  the  likelihood  (or  probability)  that  the  true  curve  will  fall 

in  the  range  represented  by  the  analysis  for  that  condition.  For  instance, 
it  could  be  assumed  that  the  intended  design  results  are  represented  by 
Condition  (l)  on  Figure  35.  The  results  from  the  design  represented  by 
Condition  (2)  are  assumed  to  stem  from  an  erroneous  analysis.  In  the 
previous  section  it  was  assumed  that  75  percent  of  the  structural  systems 
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would  fail  In  the  Condition  (l)  category  and  25  percent  in  Condition  (2) 
category.  It  was  shown  there  that  the  average  failure  rate  in  this  situation 
would  be  0.2550  for  a  6800  hour  life.  The  comparable  value  at  3000  hours 
would  be  0.010  actual  verous  0.0001  intended.  These  values  are  based  on 
systems  that  go  into  service  without  a  fatigue  test  to  disclose  errors. 

Now  consider  what  happens  when  a  fatigue  test  is  conducted.  In  the 
3000  hour  c„  the  Py  for  a  Condition  (2)  design  in  a  test  to  6000  hours 

is  0,95.  This  means  that  5  percent  of  such  designs  would  survive  the  test 
to  twice  the  nominal  life.  The  product  of  the  probability  of  obtaining  such 
a  design  (0,25)  by  the  probability  of  passing  the  test  to  6000  hours  (0.05) 
by  the  probability  of  failing  in  service  at  3000  hours  or  sooner  (0.040) 
represents  the  probability  of  having  a  failure  from  a  Condition  (2)  design. 

This  value  is  0.25  x  0.05  x  0.040  *=  0.0005.  If  those  structural  systems 
that  failed  to  pass  the  test  are  considered  to  be  redesigned  to  Condition  (l) 
status,  the  fraction  of  this  class  design  would  be  0.75  +  0.95  x  0.25  &  0.987. 
The  probability  of  failure  of  these  at  3C00  hours  would  be  0.987  x  0.0001  •- 
0.0000987.  The  combined  probability  of  failure  of  the  two  sets  of  designs 
would  be  0.000099  +  0.0005  =  0.000599.  Thus,  by  one  fatigue  test  to  twice 
the  operational  life,  the  would  be  decreased  from  O.OiO  to  0.00069.  This 

is  almost  the  Pp  of  0.0001  that  would  be  obtained  in  a  no  error  situation. 

The  corresponding  S.R.'e  would  be  from  0.99  for  no  tests  to  0.9994  for  one 
test  with  0.9999  being  the  theoretical  no  error  value.  This  simple  case 
illustrates  the  source  of  the  great  improvements  in  structural  reliability. 

Che  of  the  great  virtues  of  this  approach  is  that  it  is  net  too  sensitive 
to  the  unprovable  assumptions.  For  instance,  if  the  25-71  ratio  were  reversed 
to  75-25,  the  final  S.R.  would  only  drop  from  0.9994  to  0.9984.  The  test 
would  still  fulfill  its  function  of  disclosing  errors  and  upgrading  the  final 
S.R.  of  the  system. 

The  purpose  of  the  fatigue  test  is  to  disclose  errors  with  a  high  degree 
of  certainty.  In  Section  2.3d(3)  it  was  pointed  out  that  conducting  two  or 
more  strength  tests  of  the  same  design  would  increase  the  certainty  of  dis¬ 
closing  understrangth  designs.  The  same  principle  is  applicable  in  fatigue 
testing.  As  an  example,  the  improvement  in  the  S.R.  can  be  determined  for  the 
previous  case  when  two  fatigue  tests  are  run.  Tne  probability  of  a  service 
failure  for  «  Condition  (2.)  design  becomes  0.25  x  (0.05)2  x  0.040  ■=  0.000025. 

The  probability  for  a  Condition  (l)  design  is  0.9993  x  0.0001  =  O.OOOO9993. 

The  combined  probability  of  failure  of  the  two  sets  of  designs  becomes 
0.0001155.  Thus,  the  S.R.  hae  increased  from  0.99  for  zero  tests  to  0.9994 
for  one  test  to  0.99988  for  two  tests.  This  value  has  almost  reachsd  the 
0.9999  predicted  if  no  error  is  considfred  in  the  analysis. 

Another  technique  for  increasing  the  certainty  of  error  disclosure  is 
to  conduct  a  static  strength  test  after  completion  of  the  fatigue  test.  This 
procedure  would  reveai  those  designs  where  the  residual  strength  is  down 
significantly  but  not  enough  to  cause  a  failure  under  the  maximum  load  applied 
during  the  fatigue  test.  The  RS  distribution  after  the  completion  of  the 
fatigue  teat  would  have  the  form  defined  by  Figure  34-  The  static  test  load  can 
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be  compared  to  the  RS  strength  from  Figure  34*  The  fraction  of  structures 
with  a  hr.  less  than  the  test  load  could  be  determined  for  any  particular  test 
life.  For  the  simple  example  it  was  determined,  using  the  Volume  111  computer 
program.,  ;.hat  the  probability  of  failure  during  application  of  a  test  load 
corresponding  to  the  usual  ultimate  loao  would  be  0,997  at  6000  hours  for  a 
design  corresponding  to  Condition  (2)  on  Figure  35*  Then,  the  probability  cf 
surviving  a  6000-hour  fatigue  test,  the  static  strength  test,  and  failing  at 
the  3100-hour  service  life  become*  0.25  x  0.05  x  0.003  x  0.040  =  0.0000015. 

The  probability  of  a  Condition  (i,>  type  of  structure  failing  at  the  3000-hour 
servin',  life,  is  (1.0  -  0.0125  x  0.003;  x  0.0001  =  0.000099996.  The  combined 
probability  of  failure  of  the  two  sets  of  designs  becomes  0.000101.  In  this 
hypothetical  case  the  reliability  after  the  combined  fatigue  and  static  test 
would  be  virtually  identical  with  the  predicted  value,  despite  the  substantial 
possibility  of  an  error  in  the  analysis. 

The  fatigue  situation  is  very  analogous  to  that  depicted  on  Figures  9  and 
10,  but  with  the  abscissa  in  terms  of  hours  of  life  rather  than  load.  In  the 
example  presented  earlier,  it  was  assumed  that  25  percent  of  the  designs 
(Condition  2)  would  fail.’ prematurely  compared  to  the  intended  life.  These 
designs  would  be  the  equivalent  of  the  B,  D,  E,  K,  Q,  S,  and  T  systems  on 
Figure  9.  The  75  percent  (Condition  1)  whose  life  is  as  predicted  would 
correspond  to  Systems  A,  C,  F,  H,  J,  K,  and  0  on  Figure  9.  After  completion 
of  the  fatigue,. tests,  the  situation  would  look  more  like  that  in  Figure  10. 

In  the  discussion  on  page  83  it  was  noted  that  5  percent  of  tne  25  percent 
of  the  Condition  (2)  designs  would  pass  the  test  to  6000  hours  and  be  accepted 
for  operations.  Those  systems  that  would  be  understrength  operationally 
after  passing  the  specified  test  would  be  equivalent  to  System  Q  on  Figure  10. 
The  structural  reliability  in  the  fatigue  situation  as  veil  as  statically 
depends  on  the  certainty  with  which  the  System  Q's  will  be  rejected  during 
the  testing  procedure  and  then  redesigned  to  provide  the  desired  strength. 

The  conditional  reliability  resulting  from  various  combinations  of  test 
lifcj,  number  of  independent  fatigue  tests,  and  fatigue  tests  followed  by 
static  tests  can  be  deoe.-md.ned  by  the  Volume  III  computer  program.  The 
results  are  shown  on  Figures  38  and  39.  From  parametric  studies  of  this 
type,  deterministic  requirements  for  fatigue  testing  could  be  established. 

For  instance,  i.  the  3F  goal  is  0.999,  a  design  would  be  acceptable  if  the 
test  article  survives  to  a  test  life  3*7  times  the  specified  service  life. 

If  two  articles  are  tested  independently ,  the  test  life  could  be  reduced  to 

2.2  times  the  service  life  and  for  four  test  articles  the  test  life  would 
only  need  to  be  1.5  times  the  service  life.  If  a  static  test  to  ultimata 
load  follows  the  fatigue  test,  the  required  test  life  would  be  reduced  to 

1.2  times  service  life. 

An  analysis  of  the  conditional  5u  resulting  from  fatigue  tests  to  a 
specified  multiple  cf  the  service  life  comparable  to  Figures  38  and  39  can 
become  the  basis  for  fatigue  design  criteria.  A  table  listing  the  testing 
options  available  to  the  designer  could  be  added  to  the  present  criteria 
(Reference  15)  for  each  class  of  vehicle.  As  an  alternative,  the  test  life 
roquired  for  a  given  SR  goal  could  be  established  for  an  individual  design 
using  the  computer  program  of  Volume  III. 
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FIGURE  38.  EFFECT  OF  MULTIPLE  FATIGUE  TESTS 
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PREDICTED  (NO  ERROR)  STRUCTURAL  RELIABILITY 


FIGURE  39.  EFFECT  OF  FATIGUE  PLUS  STATIC  TESTING 


f.  Disclosure  of  Error  in  Fatigue  Loada  and  Conditions 

The  previous  section  discusses  how  to  develop  the  SR  of  a  structural 
system,  conditional  on  the  load  spectrum  being  as  predicted.  Sections  2.3e 
and  2.3f  discussed  the  problems  of  disclosing  errors  in  loads  and  in  the 
choice  of  design  conditions.  The  same  transfer  functions  govern  the  deter¬ 
mination  of  the  loads  for  fatigue  analysis  as  for  the  limit  and  omega  loads 
for  the  static  design.  Therefore,  the  loade  testing  performed  for  static 
loads  should  be  applicable  to  disclosing  errors  affecting  the  fatigue  spectrum. 
The  same  reasoning  applies  to  the  choice  of  design  conditions.  limit  and 
omega  conditions  were  orginally  chosen  on  the  basis  of  a  predicted  leading 
spectrum.  Rejection  or  acceptance  of  this  spectrum  is  discussed  in  Section  2.jf. 
If  the  spectrum  is  acceptable  for  the  static  design  conditions,  it  should  be 
equally  acceptable  for  fatigue  conditions. 

g.  Proof  of  Compliance 

The  proof  of  compliance  procedure  fo^  "proving"  that  a  structural  system 
meets  the  requirements  for  structural  reliability  is  directly  comparable  to 
that  discussed  in  Section  2.3g  for  static  conditions.  The  basic  design  is 
qualified  and  approved  by  successful  completion  of  a  fatigue  test  (or  tests) 
to  a  specified  multiple  of  the  service  life.  The  required  duration  of  the 
test  is  determined  as  discussed  in  Section  2.4e.  This  test  Life  becomes  the 
deterministic  requirement  that  converts  the  structural  reliability  goal  into 
an  administrable  requirement  as  discussed  in  Section  2.3a(2).  As  the  previous 
discussion  in  this  Section  2.4  makes  evident,  the  choice  of  the  test  life 
requirement  relative  to  the  service  life  is  based  on  statistical  considera¬ 
tions.  In  the  same  manner  that  the  static  test  will  not  reject  absolutely 
all  the  deficient  designs  (the  System  Q's  will  be  accepted),  so  the  fatigue 
test  will  not  reject  deficient  designs  with  absolute  certainty.  However, 
thosa  that  are  accepted  will  be  sufficiently  rare  relative  to  the  desired 
SR  goal  so  that  such  situations  will  be  effectively  negligible.  Therefore, 
any  system  that  survives  the  specified  test  can  be  accepted  for  operational 
usage  with  assurance  that  its  structural  integrity  will  be  at  the  desired 
level  even  though  the  SR  of  individual  designs  nay  be  somewhat  higher  or 
lower  than  the  SR  goal  established  for  that  class  of  vehicle.  To  reiterate, 
compliance  with  a  specified  structural  reliability  number  can  never  be 
proved;  compliance  with  a  specified  fatigue  test  life  is  a  simple  go,  no-go 
proposition. 
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SECTION  II. 


TECHNICAL  APPROACH 


3.1  GENERAL 

The  philosophy  or  rationale  guiding  the  development  of  the  proposed  new 
procedure  for  structural  design  criteria  is  described  in  the  previous  section. 
Specific  details  of  how  to  apply  that  philosophy  to  the  design  of  structural 
systems  are  described  in  this  section. 

3.2  CRITERIA  FORMAT 

a.  Structural  Reliability  Goal 

The  definition  of  the  structural  reliability  goal  is  the  starting  point 
of  the  now  procedure.  It  must  be  emphasized  that  the  quantity  defined  is 
a  goal,  not  a  requirement.  In  Volume  I,  it  is  pointed  out  that  there  ie  no 
procedure  for  accurately  determining  the  actual  structural  reliability  of 
a  particular  structural  design,  so  a  structural  reliability  number  cannot  be 
used  as  a  specification  requirement.  However,  establishing  a  structural 
reliability  goal  is  necessary  to  establish  the  relif'.bility  level  that  controls 
all  subsequent  requirements. 

A  structural  reliability  goal  should  be  chosen  for  each  vehicle  system. 

At  present,  it  ie  suggested  that  these  structural  reliability  goals  be 
established  by  class  of  vehicle.  For  instance,  the  structural  reliability 
goals  presented  on  Table  I  of  this  report  could  be  added  to  Table  I  of 
HIL~A-886l.l°  Typical  structural  reliability  goals  would  be  0.99  for  fighter 
class  aircraft,  0.9999  for  liaison  aircraft,  and  0.999999  for  transports. 
Alternatively,  a  share  of  the  total  vehicle  reliability  could  be  allocated  as 
the  structural  reliability  goal. 

Step  1.  Decide  on  a  structural  reliability  goal  consistent  with  the 
vehiclo  mission.  Document  the  decision  in  the  vehicle 
specification . 

b.  Expected  Operational  Usage 

In  order  to  establish  limit  and  omega  design  conditions  which  have  a 
probability  of  exceedance  in  accordance  with  those  suggested  on  Table  I, 
it  is  necessary  to  define  the  expected  operational  usage.  This  definition 
should  take  the  form  of  a  curve  of  the  probability  of  exceeding  the  parameter 
in  question.  Figure  2  ie  typical  of  tho  curves  needed  to  define  operational 
usage.  Where  insufficient  statistical  data  are  available,  this  step  can  be 
omitted  and  the  limit  and  omega  conditions  established  as  noted  in  the  next 
section.  Figure  4?  illustrates  the  fact  that  predicted  operational  usage  is 
derived  from  statistics  of  comparable  operations  in  the  past,  from  an  analysis 
of  the  operational  <. ipabilltiee  of  the  new  vehicle,  and  from  pure  Judgement. 
The  prediction  of  the  operational  usage  ie  validated  and  updated  at  several 
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places  in  the  design  and  deployment  cycle  of  the  vehicle.  First,  there 
should  be  a  specific  agreement  by  the  personnel  responsible  for  the  non- 
structural  system  concerned  with  the  particular  parameter.  In  general,  the 
agreement  will  be  based  on  the  same  type  of  data  used  by  the  structural 
organization  to  make  the  initial  prediction.  However,  the  concurrence  will 
help  to  ensure  that  the  prediction  is  realistic  relative  to  the  operational 
considerations.  Since  most  of  the  parameters  defining  the  design  conditions 
are  controllable  in  the  operation  of  the  vehicle,  the  process  of  obtaining 
concurrence  from  the  non-structural  system  will  serve  to  alert  those  concerned 
to  the  expected  operation  so  that  there  should  be  a  tendency  to  operate  the 
vehicle  in  a  manner  consistent  with  the  prediction.  The  final  validation  of 
the  prediction  can  only  come  from  comparing  actual  operations  of  the  vehicle 
with  the  predictions.  The  feed-back  of  this  information  to  the  initial 
prediction  is  shewn  on  Figure  49  and  is  noted  as  Step  9. 

Step  2.  Predict  the  operational  usage  of  the  vehicle  in  the  form  of 

a  curve  of  the  probability  of  exceeding  various  magnitudes  of 
a  particular  parameter. 

c.  Design  Conditions 


If  the  expected  operational  usage  has  been  properly  determined  in  the 
previous  step,  the  choice  of  design  conditions  is  almost  automatic.  Table  I 
defines  the  relationship  between  the  probability  of  exceeding  limit  arid 
ultimate  conditions  and  the  structural  reliability  goal.  If  the  probability 
function  is  available  from  Step  2,  the  limit  condition  is  chosen  as  that 
condition  whose  probability  of  exceedance  is  equal  to  the  appropriate  value 
from  Table  I.  The  omega  condition  is  chosen  in  the  same  fashion. 


If,  for  any  reason,  the  statistical  function  cannot  be  predicted,  limit 
and  omega  conditions  can  be  established  on  a  judgement  basis.  Whether 
determined  from  the  statistical  function  or  on  a  judgement  basis,  the 
qualitative  meaning  of  the  limit  condition  is  that  it  represents  the  upper 
bound  of  the  normal  or  expected  operational  condition.  Therefore,  if  those 
responsible  for  the  structural  system  and  those  responsible  for  the  non- 
structural  system  can  agree  that  a  particular  coi  iition  ie  necessary  for 
normal  operation  of  the  vehicle  but  that  more  severe  conditions  are  not 
necessary,  then  that  condition  by  decree  is  a  limit  condition.  By  this 
agreement,  the  structural  system  is  committed  to  "never"  failing  at  limit. 
The  non-structural  system  is  committed  to  operating  "most"  of  the  time  at 
lass  than  the  limit  condition. 


The  omega  condition  can  be  established  on  the  same  kind  of  Judgement 
basis  as  the  limit  condition  if  statistical  data  are  not  available.  However 
chosen,  if  it  is  agreed  for  the  structural  and  non-structural  systems  that 
the  omega  condition  is  an  extreme  condition  reached  only  in  abnormal 
operational  situations  and  beyond  which  no  structural  capability  is  needed, 
the  omega  condition  is  established  by  the  agreement.  In  most  cases,  the 
approach  to  omega  conditions  can  be  controlled  by  observing  the  prohibition 
against  exceeding  the  limit  condition.  The  structural  system  accepts  the 
responsibility  for  assuring  that  most  of  the  individual  structures  will 
survive  the  omega  condition,  but  with  absolutely  no  need  for  capability 
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to  survive  beyond  the  omega  condition. 

Stag  3.  EstabHah  the  various  limit  and  omega  conditions  which  define 
the  performance  requirements  for  the  structural  system  and 
operational  limitations  for  the  non-structural  systems. 

d.  Design  Loads  for  Limit  Conditions 

The  structural  loads  associated  with  each  limit  condition  are  calculated 
by  the  same  procedures  that  would  be  used  in  the  Present  System.  These  limit 
loads  are  then  multiplied  by  a  Limit  Test  Factor  of  Safety  to  obtain  design  loads. 
The  only  difference  between  the  design  loads  of  the  new  procedure  and  the 
ultimate  loade  of  th#  Present  System  is  that  the  Limit  Test  Factor  of  Safety  to 
be  applied  to  the  limit  loads  is  not  a  fixed  number.  It  is  defined  by 
Figures  24  and  25.  This  factor  of  safety  depends  on  the  structural  reliability 
goal  established  in  Step  1  and  the  strength  scatter,  Ta,  of  the  structure 
when  subjected  to  the  environment  associated  with  each  particular  limit 
condition.  Thus,  the  y_  may  vary  from  one  condition  to  another  and  from  one 
consonant  of  the  vehicle  to  another. 

Step  4.  Calculate  the  design  loads  for  the  limit  conditions  by 

multiplying  the  limit  loads  associated  with  the  various  limit 
conditions  by  the  limit  factor  of  safety  defined  on  Figures 
24  and  25< 

e.  Design  Loads  for  Omega  Conditions 

The  design  loads  for  omega  conditions  are  determined  in  a  manner 
analagous  to  those  for  limit  conditions.  The  loads  associated  with  each 
omaga  condition  are  calculated  and  multiplied  by  an  omega  factor  of  safety. 

It  should  be  noted  that  the  omega  factor  of  safety  Is  a  completely  different 
function  than  the  limit  factor  of  safety.  As  shown  or.  Figures  12  and  20,  the 
omega  factor  of  safety  will  be  1.0  for  most  conventional  structures  with 
relatively  low  strength  scatters.  In  principle,  the  differences  between 
omega  loads  and  limit  loads  are  no  greater  than  those  between  two  different 
limit  conditions  in  the  Present  System.  In  practice,  there  may  be  some 
difficulties  in  determining  omega  loads.  One  of  the  obvious  differences 
between  limit  and  omega  loads  (used  in  the  broad  sense  discussed  in  Section 
2.3*(3))  i»  that  the  temperatures  for  the  omega  condition  may  be  higher  than 
those  for  the  corresponding  limit  condition  because  the  omega  velocities  and 
flight  attitude  may  be  greater.  Because  the  omega  conditions  are  extreme 
conditions,  non- linearities  in  aerodynamic  loads  will  be  more  prevalent. 
Aaroelastic  effects  will  be  larger  and  in  some  cases  will  involve  yielding  of 
the  structure.  The  difference  in  calculating  limit  and  omega  loads  is  one  of 
degree,  not  one  of  basic  procedure.  The  strength  scatter,  >'5,  for  the  omega 
condition  may  be  different  than  the  Ya  for  the  limit  condition.  This  should 
be  considered  in  determining  the  omega  factor  of  safety  from  Figures  12  and  20. 

Step  5.  Calculate  the  design  loads  for  the  omega  conditions  by 
multiplying  the  omega  loads  associated  with  the  various 
omega  conditions  by  the  omega  factor  of  safety  defined 
on  Figures  12  end  20. 
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f.  Strength  Requirement  for  Structural  System 

The  strength  analysis  under  the  new  procedure  is  very  comparable  to  that 
under  the  Present  System.  Margins  of  safety  are  calculated  using  allowables 
that  have  the  same  meaning  as  they  do  under  the  present  3y3tem.  In  many  cases, 
particularly  whore  temperature  differences  are  not  significant,  the  allowables 
at  limit  and  omega  conditions  will  be  identical.  It  will  be  obvious  whether 
the  design  loads  for  the  limit  or  the  omega  condition  are  the  more  critical. 

In  such  cases,  only  the  critical  condition  would  need  to  be  considered  and  the 
entire  procedure  becomes  equivalent  to  that  in  the  Present  System.  In  other 
cases,  the  allowables  for  the  omega  condition  may  be  less  than  those  for  the 
corresponding  limit  condition  but  the  limit  factor  of  safety  may  be  larger 
than  the  omega  factor  of  safety.  In  such  cases,  the  critical  condition  may 
not  be  obvious  and  both  limit  and  omega  condition  will  need  to  be  analyzed. 

Step  6.  Substantiate  the  strength  of  the  structural  system  in  reports 
comparable  to  those  required  by  Paragraph  3*7  of  MIL-A-8868.17 

Use  allowables  from  KIL-HDBK-5-'-®  and  comparable  sources  to 
calculate  margins  of  safety. 

g.  Proof  of  Compliance  with  Strength  Requirements 

Strength  tests  in  which  the  test  structure  successfully  supports  the 
design  loads  for  the  limit  and  omega  conditions  constitute  proof  of 
compliance  with  the  strength  requirements.  The  requirements  of  the  new 
procedure  for  testing  are  comparable  to  those  of  the  present  procedure. 

There  is  a  sharp  line  of  demarcation  between  compliance  and  non-compliance 
so  there  can  be  no  question  of  whether  or  not  the  test  is  successful.  The 
difference  between  the  new  procedure  and  the  Present  System  is  the  nunber  of 
tests  required.  Proof  of  compliance  for  both  limit  and  omega  conditions  is 
necessary  although  a  single  test  will  satisfy  both  requirements  in  most  cases. 
In  addition,  the  Test  Factor  of  Safety  may  be  based  on  multiple  tests  to 
reduce  the  factor  of  safety  as  shown  on  Figures  20  and  25.  If  this  option 
has  been  selected,  two  or  more  nominally  identical  tsst  articles  must  be 
fabricated  and  each  must  complete  the  specified  test  without  failure.  The 
proof  of  compliance  for  the  fatigue  situation  is  comparable  to  that  in  the 
Present  System.  The  differences  are  that  the  ratio  between  test  life  and 
nominal  service  life  depends  on  the  fatigue  scatter  factor,  the  structural 
reliability  goal,  the  number  of  test  articles,  and  whether  a  static  test  is 
conducted  after  completion  of  the  fatigue  test. 

Step  7.  Prove  compliance  with  the  strength  requirements  by  successfully 
completing  static  tests  for  all  of  the  critical  limit  and  omega 
design  loads.  Complete  fatigue  tests  to  the  test  life  defined 
on  Figures  38  and  39. 

h.  Validation  of  Lindt  and  Omega  Loads 

Procedures  to  validate  the  calculation  of  limit  loads  are  essentially 
Identical  with  present  practice.  Operational  limitations  will  usually 
preclude  any  flight  measurement  programs  beyond  limit  conditions.  However, 
much  can  be  accomplished  towards  verifying  the  loads  (really,  disclosing 
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possible  error* )  by  indirect  procedure*  as  dlscuesed  in  Section  2.3g(2). 

Step  8.  Validate  the  limit  and  omega  loads  associated  with  the  limit 
and  omega  conditions.  Measure  limit  loads  directly.  Extra¬ 
polate  measured  loads  to  omega  conditions  by  validating 
parametric  functions  to  the  greatest  extent  possible  by  full- 
scale  flight  tests  and  by  wind-tunnel  tests. 

i.  Validation  of  Limit  and  Ctaega  Conditions 

The  previous  procedures,  if  properly  carried  out,  ensure  that  the 
structure  will  attain  the  desired  structural  goal  provided  that  the  probability 
of  exceeding  limit  and  omoga  conditions  is  no  greater  than  was  predicted  when 
the  conditions  were  eelected.  Various  sources  of  information  such  as  eight- 
channel  statistical  data  or  a  count  of  the  nunfeer  of  times  "red-line"  values 
are  exceeded  can  be  uaed  to  decide  if  the  vehicle  is  being  operated  in  a 
manner  consistent  with  the  expected  probabilities  for  exceeding  limit  and 
omega  conditions.  Tests  such  as  described  in  Section  2.3f  and  2.3g(3) 
should  be  employed  to  validate  the  choice  of  limit  and  omega  design 
conditions. 

Step  9.  Validate  the  limit  and  omega  design  conditions  by  monitoring 
actual  operations  and  comparing  actual  operational  usage  with 
the  predicted  values  used  as  the  original  basis  for  the 
design.  If  the  actual  usage  ie  greater  than  acceptable  for 
the  design  conditions,  take  steps  to  modify  the  operations 
or  to  increase  the  strength,  as  necessary. 

J .  Structural  Failure  Situations 

In  the  event  that  a  failure  in  the  structural  system  should  ever  occur, 
the  new  procedure  would  not  change  present  procedures  for  determining  the 
cause  and  for  taking  remedial  action.  The  deterministic  nature  of  the 
requirements  and  well-defined  lines  of  demarcation  in  defining  understrength 
or  overload  regions  will  assist  in  determining  a  probable  cause  in  any 
failure  investigation.  Section  2.3h  and  Figure  U1  indicate  soma  of  the 
decisions  that  may  result  from  an  accident  investigation. 

Step  10.  Decide  on  a  cause  of  failure  and  the  action  no  take  in 
case  of  any  structural  failure. 
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SECTION  IV 


.FUNCTIONAL  FLOW  DIAGRAMS 


The  visualization  of  the  various  functions  that  contribute  to  the  final 
decision  that  the  structural  system  has  a  satisfactory  structural  reliability 
can  be  aidsd  by  functional  flow  diagrams  such  as  presented  in  this  section  of 
the  report.  The  terminology  and  format  used  in  these  diagrams  is  discussed 
in  detail  in  Volume  I.  Figure  1  in  this  volume  reproduces  from  Volume  I  the 
Generalised  Functional  Diagram  —  Structural  Design  System. 

In  Figure  1  (and  in  the  various  diagrams  of  Volume  I),  the  portion  of 
the  structural  design  system  involving  the  collection  and  application  of 
information  to  make  decisions  has  been  designated  as  the  Informatics  field. 

In  crdar  to  decide  that  the  structural  system  is  satisfactory,  it  is  necessary 
to  determine  the  results  actually  being  achieved  in  terms  that  may  be 
directly  coaqpared  with  corresponding  data  that  represent  desired  results. 

In  Volume  I,  following  the  concepts  introduced  by  Draper  in  Reference  1, 
the  comparison  is  made  from  data  generated  in  a  Desired  State  Information 
System  (DSIS)  and  an  Actual  State  Information  System  (ASIS).  It  was  noted 
in  Section  2.2  that  these  functions  are  phrased  in  the  language  used  by 
Draper^  but  that  this  language  was  just  a  formalism  for  what  is  really  common 
sense. 

The  basic  elements  of  the  Informatics  section  of  the  Proposed  Structural 
Design  System  are  presented  cn  Figure  1 G.  This  figure  shows  that  the  Desired 
State  is  established  from  the  vehicle  mission  through  choice  of  a  structural 
reliability  goal  to  the  definition  of  limit  and  omega  conditions  that  are 
consistent  with  the  S.R.  goal.  Then,  the  Desired  State  is  divided  into  two 
parts.  First,  the  strength  of  the  structural  system  should  be  consistent  with 
the  defined  limit  and  omega  conditions.  Second,  the  operations  of  the  vehicle 
must  be  consistent  with  the  defined  limit  and  omega  conditions.  If  the 
Desired  State  represented  by  these  two  functions,  strength  and  operations,  is 
achieved,  the  S.R.  goal  will  be  achieved.  The  licit  and  omega  conditions 
are  discrete  conditions  that  can  be  defined  numerically.  The  meaning  of  the 
term  "consistent  with  defined  limit  and  omega  conditions"  can  be  quantitized 
as  aiscussed  in  Section  II.  Also,  it  is  outlined  in  mors  detail  in  subsequent 
figures  in  this  section.  Therefore,  it  is  possible  to  determine  the  Actual 
State  and  compare  it  with  the  Desired  State. 

The  determination  of  the  Actual  State  of  the  strength  of  the  structural 
system  is  determined  in  three  phases,  as  it  has  always  been.  First,  the 
strength  is  determined  analytically ;  then,  it  is  verified  by  strength  test; 
and,  finally,  operational  results  furnish  some  additional  information  on  the 
strength  of  the  system.  There  ere  two  sources  of  information  on  the  Actual 
State  of  operational  usage.  These  are  (l)  analytical  predictions  before 
operations  begin,  and  (2J  data  from  monitoring  the  actual  operations  in 
various  ways  such  as  by  simply  noting  in  log  books  when  a  red- line  is 
exceeded  or  by  elaborate  eight-channel  recording  programs. 
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When  thiB  information  on  the  Actual  State  is  compared  with  that  for  the 
Desired  State,  management  decisions  can  be  made  that  operations  with  the 
r'ehicle  and  the  strength  of  the  vehicle  are  consistent  with  the  limit  and 
omega  conditions.  From  these  two  decisions  follow  the  decision  that  the 
structural  system  has  a  satisfactory  S.R.  level  for  the  vehicle  as  operated. 

If  *  ho  decision  is  negative,  tne  decision  can  lead  to  corrective  action  to 
improve  the  situation. 

The  chain  of  decisions  leading  from  definition  of  the  new  vehicle  concept 
to  the  final  decision  that  the  S.R.  level  is  satisfactory  is  presented  as  a 
Structural  Reliability  Decision  Network  in  Figures  41  through  48.  The  need 
for  each  of  these  decisions  is  discussed  to  some  degree  in  Section  II.  With 
this  discussion  as  background  it  appears  that  Figures  41  through  48  are  self- 
explanatory.  Each  of  these  decision  boxes  represents  a  contributing  factor  to 
the  final  decision  on  Figure  48  and  the  corresponding  decision  on  Figure  40. 
These  individual  decisions  are  supported  by  the  appropriate  Actual  State/ 
Desired  State  Information  System.  These  supporting  ASIS/DSIS  represent  detail 
portions  of  the  corresponding  systems  on  Figure  40.  The  supporting  ASIS/DSIS 
systems  for  some  (but  not  all)  of  the  decision  boxes  on  Figures  41  through  48 
are  presented  on  Figures  49  through  55.  The  decision  made  is  indicated  by 
the  double  lines  on  the  appropriate  boxes.  The  small  numbers  on  the  lower 
lefthand  corner  of  these  boxes  are  identical  with  the  number  on  the  correspond¬ 
ing  box  in  the  Decision  Network  (Figures  41  -  48).  These  diagrams  also 
correspond  to  similar  diagrams  in  Volume  I.  Tne  meaning  of  the  individual 
boxes  is  discussed  in  detail  in  Section  II  of  this  report. 
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FIGURE  40.  INFORMETICS  SECTIONS  -  PROPOSE)  STRUCTURAL  DESIGN  SYSTEM 


FIGURE  U.  STRUCTURAL  RELIABILITY  DECISION  NETWORK  (DESIGN  CONDITIONS) 


IILITT  DECISION  NETWORK  (VEHICLE  PRODUCTION  AND  OPERATION) 


FIGURE  4 6.  STRUCTURAL  RELIABILITY  DECISION  NETWORK  (VALIDATION  OF  OPERATIONAL  USAGE) 
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FIGURE  1*9.  ASIS/DSIS  USAGE  DECISION 


FIGURE  50.  A5IS/DSIS  CONDITIONS  DECISION 


FIGURE  51.  ASIS/DSIS  LOADS  DECISION 


FIGURE  52.  ASIS/DSIS  STRENGTH  SCATTER  DECISION 


FIGURE  53.  ASIS/DSIS  TEST  FACTOR  OF  SAFETY 
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FIGURE  55.  ASIS/DSIS  STRENGTH  COMPLIANCE  DECISION 


SECTION  V 


SYNOPSIS  OF  NEW  PROCEDURE 


5.1  GENERAL 

The  new  procedure,  developed  In  the  study  documonted  in  the  three  volumes 
of  this  report,  defines  the  requirements  for  quantitative  structural  criteria 
based  on  statistical  considerations.  Because  of  the  necessity  to  thoroughly 
Justify  and  explain  tha  new  procedure,  the  documentation  is  quite  lengthy.  It 
is  recognized  that  there  are  many  who  will  m  t  be  able  to  study  the  complete 
development  of  tha  new  procedure  but  who  desire  to  understand  the  es-.sence  of 
tho  new  procedure.  The  synopsis  presented  in  this  section  is  designed  to 
satisfy  that  need.  The  entire  procedure  is  summarized  in  seven  steps  at  the 
end  of  this  section. 

First  of  all,  the  proposed  new  procedure  represents  a  modification  of  the 
Present  (Factor  of  Safety)  Structural  Design  System,  not  a  completely  different 
approach.  The  form  of  the  procedure  is  unchanged  although  the  numbers  and  the 
meaning  of  the  numbers  may  differ.  Structural  designers  and  analysts  do  not, 
need  to  unlearn  their  present  methods  and  learn  new  ways  for  designing 
structural  system*.  It  is  considered  to  represent  a  desirable  characteristic 
when  experienced  engineers  comment,  "But  this  procedure  is  really  not  much 
different  from  what  we've  always  done." 

The  new  procedure  allows  —  in  fact,  requires  —  consideration  of  the 
statistical  distribution  of  those  parameters  that  truly  affect  structural 
integrity  (quantltized  as  structural  reliability).  However,  all  of  the 
statistical  manipulations  are  performed  at  the  beginning  of  the  analytical 
procedure.  The  statistical  operations  are  uesd  to  make  decisions  that  define 
deterministic  values  for  design  conditions  and  for  factors  applied  to  the 
loads  associated  with  these  deterministic  conditions.  The  loads  analyst,  tha 
strength  analyst,  the  structural  designer,  and  the  structural  test  engineer 
will  be  working  with  discrete  conditions,  discrete  loads  and  discrete  strength 
allowables  Just  as  they  always  have. 

5.2  BASIC  CONCEPT 

The  basic  concept  of  the  new  procedure  is  that  the  structural  system 
should  have  the  structural  capability  to  survive  designated  overload  and 
underatrength  situations.  The  Present  (Factor  of  Safety)  Structural  Design 
System  provides  such  capability  through  application  of  a  factor  of  safety  to 
the  limit  load#  to  determine  design  ultimate  load#.  However,  it  provides  this 
capability  indirectly  and  in cone latently.  It  is  noted  in  Section  2.2  that 
cr.s  vehicle  with  a  i.5  factor  of  safety  might  be  able  to  attain  1.75  times  the 
limit  operational  condition  while  another  vehicle  with  the  same  factor  of 
safety  might  attain  only  1.25  times  ths  limit  operational  condition.  Also, 
it  la  pointed  out  in  Section  2.3d(L)  that  structures  with  a  large  ecatter  in 
strength  will  fail  largely  due  to  understrsngth  rather  than  from  overload. 
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As  a  result  of  such  considerations,  the,  proposed  new  procedure  departs 
from  the  Present  System  by  establishing  explicit  requirements  for  understrength 
and  overload  situations.  These  requirements  are  separate  and  distinct  and  are 
based  on  probabilities  and  statistics  so  as  to  be  consistent  with  a  level  of 
structural  reliability  appropriate  to  the  vehicle  mission.  An  illustration  of 
the  separate  provisions  for  understrength  and  overload  situations  is  presented 
in  Figure  56.  The  central  bar  of  Figure  56  indicates  that  the  limit  design 
load  includes  a  provision  to  handle  structures  that  are  understrength  so 
"no  failure"  will  occur  at  the  limit  load.  This  requirement  is  discussed  in 
detail  in  Sections  2.3a(l)  and  2.3d(4).  The  right  or  the  left  bar  indicates 
the  overload  provision  discussed  in  Sections  2.3a(l)  and  2.3d(3).  The  left 
bar  illustrates  the  situation  when  a  relatively  large  overload  provision  is 
necessary  so  that  this  requirement  is  more  critical  than  the  understrength 
provision.  The  right  bar  shows  the  situation  when  the  overload  provision  is 
relatively  small.  In  this  case  the  understrength  provision  is  more  critical 
and  governs  the  design.  Chce  the  appropriate  design  values  are  chosen,  they 
are  as  deterministic  and  as  easy  to  administer  as  the  corresponding  values  in 
the  present  system. 


5.3  DETAIL  PROCEDURE 

a.  Structural  Capability  Requirements 

The  starting  point  of  the  procedure  is  to  adopt  a  structural  reliability 
(S.R.)  goal.  It  is  expected  that  these  goals  would  be  established  for  various 
classes  of  vehicles  as  suggested  on  Table  I.  Thus,  a  fighter  aircraft  might 
have  an  S.R.  goal  of  0.99;  a  bomber,  0.9999;  and  a  transport,  0.999999. 

However,  more  or  different  S.R.  goals  might  be  established.  It  is  quite 
feasible  to  choose  the  S.R.  goal  so  as  to  be  consistent  with  the  reliability 
of  other  vehicle  subsystems,  if  this  action  is  appropriate. 

From  the  S.R.  goal,  two  numbers  are  derived  representing  the  probability 
of f exceeding  an  operational  limit  condition  and  the  probability  of  exceeding 
an  operational  omega  condition.  Suggested  values  for  these  two  probabilities* 
are  given  on  Table  I.  The  definition  and  meaning  of  the  omega  condition  will 
be  taken  up  later.  A  limit  condition  in  the  new  procedure  represents 
essentially  the  same  thing  that  it  does  in  the  Present  System.  This  means  that 
a  limit  condition  is  the  upper  bound  of  the  normal  or  expected  operational 
conditions.  The  statistical  definition  of  the  frequency  of  exceeding  a  limit 
condition  is  an  extension  to  the  Present  System.  However,  it  is  not  intended 
that  the  new  procedure  will  change  the  numerical  values  of  limit  conditions 
significantly  from  those  specified  in  the  Present  System.  Furthermore,  if 
there  are  insufficient  statistical  data  available  to  make  a  good  prediction 
of  the  probability  of  exceeding  the  limit  condition,  the  limit  condition  can 
be  chosen  on  a  judgement  basis.  Since  the  design  limit  condition  serves  as 
the  bisis  for  operational  limitations,  it  should  be  just  high  enough  so  that 
most  normal  operations  can  be  conducted  without  exceeding  the  limit  condition. 

In  effect,  the  statistical  calculations,  on  which  the  choice  of  a  limit 
condition  is  based, .are  a  prediction  of  the  expected  results  in  future 
operations  from  a  knowledge  of  past  results.  Even  if  it  is  necessary  to  base 
the  choice  of  a  limit  condition  on  a  judgement  decision,  the  decision  is 
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FIGURE  56.  OVERLOAD  AND  UNDERSTRENGTH  REQUIREMENT: 


•till  a  prediction  of  future  r««ult*»  The  onlj  difference  is  that  the  Judge¬ 
ment.  prediction  is  less  sophisticated  than  the  3tstistical  prediction.  Thu 
final  structural  relifoility  of  a  vehicle  is  rather  insensitive  to  the  actual 
probability  cf  exceeding  lurdt  condition  so  the  choice  is  not  too  critical. 

The  definition  of  a  limit  condition  is  the  first  stop  in  establishing 
the  performance  requirements  for  a  structural  system.  Since  a  limit  condition, 
by  definition,  is  a  normal  or  expected  condition  and  is  established  as  a 
permissible  condition  by  the  operating  limitations,  structural  failure  Is  not 
acceptable  at,  limit  condition  or  less.  Rut,  even  if  perfect  S.R.  up  to  limit 
conditions  ware  attained  so  that  no  structural  failure  ever  occurred  below 
limit  condition,  it  would  not  be  enough  to  insure  that  the  structural 
reliability  goal  would  be  reached.  Most  structural  failures  occur  as  a  result 
of  overloading  the  structure  beyond  the  established  limit  conditions.  There¬ 
fore,  some  requirement,  for  structural  capability  beyond  limit  condition  and 
some  control  of  the  frequency  of  encountoring  an  overload  condition  must  be 
established  if  a  structural  reliability  goal  is  to  be  mat. 

This  need  to  establish  the  overload  capability  of  the  structural  system 
is  the  basis  for  inti  oducing  the  concept  of  an  omega  condition  to  the  new 
procedure.  To  illustrate  this  need,  suppose  that  the  structures  in  a  fleet  of 
vehicles  were  designed  to  Just  barely  survive  an  operational  condition  sub¬ 
stantially  above  the  limit  condition.  But  suppose  that  this  overload  condition 
occurred  on  one  out  of  every  ten  vehicles.  Then,  the  structural  reliability 
of  the  fleet  could  not  be  higher  than  0.9  even  if  none  of  the  failures  occurred 
below  the  limit  condition.  Conversely,  if  an  operational  condition  can  be 
defined  whose  probability  of  exceedance  is  the  complement  of  the  desired 
structural  reliability,  the  S.R.  goal  -will  be  attained  if  the  structural  system, 
can  always  survive  this  condition.  It  is  axiomatic  that  a  one-in-a-mixiion  levex 
of  reliability  (S.R.  =  0.999999)  cannot  be  obtained  if  the  structure  cannot 
survive  a  condition  that  occurs  on  more  than  one-in-a-ndllion  vehicles. 

Therefore,  the  definition  of  such  a  condition  is  a  necessary  step  in  defining 
a  structural  system  that  will  meet  a  desired  S.R.  goal.  Any  operational 
condition  that  has  a  probability  of  being  exceeded  which  is  equal  to  the 
complement  of  the  dorirad  S.R.  goal  is  designated  as  an  omega  condition. 

The  initial  choice  of  Unit  and  omega  conditions  is  based  on  statistical 
considerations  governed  by  the  desired  S.R.  However,  once  the  choice  is  made 
the  two  conditions  become  completely  deterministic.  Whether  or  not  the  limit 
and  omega  conditions  truly  satisfy  the  statistical  expectations  that  led  to 
their  choice  is  not  germane.  These  conditions  explicitly  define  the  interface 
between  structural  performance  requirements  and  operational  constraints.  This 
interface  is  deliberately  placed  at  the  operational  condition,  such  as  load 
factor,  velocity  and  weight,  which  can  be  measured  and  controlled  during 
flight  and  ground  operations.  Once  stated,  the  limit  and  omega  conditions 
become  independent  and  divorced  from  their  origin.  They  represent  the  ^ 
structural  capability  that  should  be  provided  by  the  structural  system,  may 
also  define  the  level  of  operational  usage  that  must  not  be  exceeded  if  the 
desired  S.R.  is  to  be  attained.  The  numbers  defining  the  limit  and  omega 
conditions  represent  definable,  administrable  performance  requirements  for  the 
structural  system.  The  significance  of  these  requirements  can  be  described 
In  qualitative  terms  to  develop  an  appreciation  of  the  intent  behind  the 
definition.  Then,  a  quantitative  definition  of  the  requirements  will  follow. 
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The  limit  condition  lo  an  expected  and  permissible  operational  condition 
50  the  structural  system  should  never  fail  at  limit.  The  liudt  condition  is 
the  upper  bound  of  normal  operations  sc  axcesdance  of  the  lirnit  condition 
should  not  occur  unless  something  in  abnormal  in  the  vehicle  operation.  For 
those  conditions  that  ar6  controllable  by  man  or  by  other  subsystems, 
exceedance  of  a  limit  condition  represents  a  violation  of  an  operational 
limitation. 

The  omega  condition  is  not  an  expected  operational  condition  and  it 
usually  represents  a  gross  violation  of  the  operational  limitation.  Most  of 
the  structural  systems  should  survive  the  omega  condition  but  there  is  no 
requirement  for  any  structural  capability  beyond  the  omega  condition.  Con¬ 
sequently,  if  there  is  any  vehicle  operation  at  or  beyond  the  omega  condition 
failure  may  be  expected  to  occur.  This  definition  of  a  finite  upper  bound  on 
the  required  structural  capability  is  an  import  art  characterist  ic  of  the  new 
procedure.  It  avoids  the  difficulty  inherent  in  a  Purely  Statistical  Structural 
Reliability  System  where  the  structural  capability  needed  to  provide  a  given 
S.R.  cannot  be  predetermined  since  it  depends  on  how  the  vehicle  is  operated. 

In  the  new  procedure  responsibility  for  preventing  structural  failures  beyond 
the  omega  condition  by  avoiding  such  operations  is  explicitly  transferred  to 
other  non-struc-tur&l  systems. 

The  preceding  discussion  is  intended  to  make  crystal  c^ear  the  fact  that 
the  reliability  of  a  structural  system  depends  on  considerations  beyond  the 
purview  of  those  responsible  for  the  structural  system.  Structural  reliability 
is  not  something  intrinsic  in  the  structural  system.  The  S.R.  achieved  by  a 
given  system  may  be  high  if  operated  one  way  and  veiy  low  if  operated  in  a  more 
severe  manner.  Achieving  structural  reliability  depends  on  two  separate  and 
distinct  considerations.  First,  the  structural  system  obviously  must  be  at  the 
strength  level  defined  by  the  specified  structural  performance  requirements. 
Second,  and  not  so  obvious,  the  interface  with  non- structural  systems  must  be 
explicitly  defined  and  operations  must  be  so  controlled  that  they  do  not  exceed 
the  overload  capability  of  the  structural  system. 

The  structural  performance  requirements  previously  defined  as  no  failure 
at  limit  condition  and  most,  if  not  all,  structures  surviving  the  omega  condi¬ 
tion  must  be  qualified  slightly  before  the  requirements  -.an  become  the  basis 
of  a  realistic  procedure.  "No"  failure  at  limit  mat  be  redefined  to  "very 
rare"  failure  at  limit.  "Vei-y  rare”  is  quantitized  by  a  probability  of  failure 
goal  at  limit  condition  which  is  related  to  the  total  probability  of  failure 
that  will  be  tolerated.  If  the  probability  of  failure  at  limit  is  no  mere 
than  one  percent  of  the  total  Pp  as  suggested  in  Table  I,  such  a  value  can  be 
considered  to  be  rare  in  the  context  of  the  tolerable  number  of  failures. 

This  one  percent  goal  serves  as  the  basis  for  determining  the  design  and  test 
requirements  for  limit  conditions  in  the  new  procedure. 

b.  Structural  Strength  Requirements 

If  the  strength  distribution  were  known  precisely,  the  relationship 
between  the  limit  condition  loads  snd  the  strength  allowable  (usually  the 
99-percent-exceed  value)  needed  to  provide  a  given  S.R.  oould  be  determined 
by  standard  statistical  procedures.  However,  the  strength  distribution  cannot 
b*e  assumed  to  be  known.  Reference  6  documents  the  fact  that  structures  fail 
during  strength  teate  relatively  frequently  at  levels  substantially  below  the 
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valued  expected  on  the  basis  of  a  ■u.-^ngth  analysis.  Figure  9  show3  a  typical 
distribu*  ion  of  the  strengths  resulting  in  a  group  of  different  structural 
systems  from  analysis  alone.  Figure  5  indicates  that,  if  future  designs  are 
r.c  better  or  worse  than  past  designs,  about  13  percent  of  the  structures 
would  fail  at  Limit  load.  This  value  is  three  orders  of  magnitude  higher  than 
the  highest  value  suggested  in  Table  I.  Therefore,  analysis  alone  is  consiaered 
inadequate  for  obtaining  structural  designs  that  will  very  rarely  fall  at  limit 
condition. 


The  concept  of  error  disclosure  by  strength  testing  is  developed  ir. 
Section  2.3d.  The  strength  test  is  usually  very  effective  ir.  this  capacity 
because  the  probability  that  a  system  such  as  B,  E,  or  K  in  Figure  9  would 
pass  a  test  to  the  design  load  and  then  fail  at.  limit  load  i3  extremely  low. 
Unfortunately,  there  is  some  probability  that  an  underdesigned  system  such 
as  system  Q  in  Figure  10  will  pass  the  strength  test  and  be  accepted  for 
operation  as  shown  in  Figure  10.  The  larger  the  strength  scatter  (coefficient 
of  strength  variation),  y  s,  the  more  likelihood  that  a  test  article  that  ie 
much  stronger  than  the  mean  strength  will  pass  the  test  to  be  followed  by 
lailure  of  an  operational  vehicle  that  is  much  weaker  than  the  mean. 

The  relationship  between  the  test  load  necessary  to  reject  understrength 
designs  with  a  sufficiently  high  degree  of  certainty  and  the  strength  scatter 
is  shown  in  Figures  24  and  25.  The  simple,  deterministic  action  of  success¬ 
fully  passing  a  strength  test  to  loads  determined  by  the  Limit  Test  Factor  of 
Safety  3r.own  on  Figures  24  and  25  will  assure  that  the  probability  of  failure 
at  limit  condition  will  be  consistent  with  the  S.R.  goal  for  the  particular 
vehicle.  In  effect,  this  Limit  TFS  makes  the  necessary  provision  against 
understrength  failures  for  each  structural  design. 

In  addition  to  the  requirement  that  structures  should  rarely  fail  at 
limit  conditions,  it  was  stated  that  most  of  the  structures  should  survi\ a  the 
omega  condition.  This  requirement  i3  related  to  insuring  that  the  structure 
will  meet  the  overall  S.R.  goal.  Comparable  problems  of  analytical  error 
and  certainty  of  error  discxosure  by  test  exist  for  the  omega  condition  as  for 
the  Unit  condition.  In  order  to  insure  that  the  structure  will  survive  the 
omega  condition  with  a  degree  of  certainty  compatible  with  the  S.R.  goal 
established  for  the  vehicle,  the  structural  system  must  be  designed  and  tested 
to  loads  corresponding  to  the  omega  condition  multiplied  by  the  omega  TFS 
defined  in  Figures  12  and  20.  It  should  be  understood  that  these  omega  Icais 
do  not  necessarily  have  a  factorial  relationship  to  limit  loads.  Any  non- 
linaarities  in  load  between  limit  and  omega  should  be  accounted  for.  Any 
difference  in  temperature  should  be  accounted  for.  Furthermore,  there  may  be 
a  difference  In  allowables  and  scatter  factor,  1  ,  associated  with  each  limit 
and  omega  condition  that  should  be  recognized.  The  single,  deterministic 
action  of  passing  a  strength  test  to  loads  determined  by  the  Ctaega  Test  Factor 
of  Safety  shown  in  Figures  12  and  20  will  assure  that  the  total  probability 
of  failure  will  be  consistent  with  the  S.R.  goal  for  the  particular  vehicle 
and  that  most  structural  systems  will  survive  the  omega  condition.  •  In  effect, 
this  Omega  TFS  makes  the  necessary  provision  against  overload  failures  for 
each  structural  design. 

Restated,  the  new  procedure  requires  the  specification  of  two  separate 
and  distinct  operational  conditions,  limit  and  omega.  The  first  defines  the 
situation  where  provisions  against  failures  due  to  understrength  must  be 
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introduced.  The  second  defines  the  strength  that  must  be  provided  to  handle 
overload  situations.  The  factors  applied  to  limit  and  omega  load3  are 
determined  as  a  function  of  the  strength  scatt3r  factor,  yg.  In  all  other 

aspects,  the  new  procedure  is  very  comparable  to  the  Present  System.  By 
making  these  modifications ,  the  new  procedure  has  the  capability  to  provide 
consistent  level  of  structural  reliability  in  varying  circumstances.  In 
particular,  the  desired  S.R.  can  be  maintained  even  when  the  strength  scatter 
is  increased  to  much  higher  values  than  have  been  common  in  the  past. 

Undoubtedly,  even  more  important  to  the  design  of  light  weight  but 
reliable  structures  is  the  ability  to  isolate  each  of  the  parameters  that 
control  the  true  structural  reliability.  Ey  so  doing,  the  design  factors 
required  to  provide  a  given  level  of  S.R.  can  be  reduced  to  any  desired  value, 
provided  that  the  structural  configuration  and  the  operational  limitations  are 
controlled  accordingly.  This  cannot  be  done  at  present  because  the  Factor  of 
Safety  in  the  Present  System  is  not  identified  with  any  specific  requirement 
for  understr8.ngth  or  overload.  Controlling  one  without  the  cpner  will  net 
necessarily  maintain  a  desired  level  of  structural  reliability.  Therefore,  the 
effect  ol  reducing  the  Factor  of  Safety  in  the  Present  System  is  net  really 
determinable. 

Explicit  actions  to  minimize  the  structural  design  requirements  while 
maintaining  a  desired  level  of  S.R.  are  relatively  simple.  First,  the 
performance  requirements  for  the  structural  systom  must  be  minimised.  As 
always,  any  reduction  in  the  limit  condition  will  result  in  a  lighter  weight 
structure.  In  the  new  procedure  there  is  no  specific  relationship  between 
limit  and  omega  conditions.  This  permits  the  choice  of  an  omega  condition 
(which  controls  the  overload  capability  of  the  structure)  that  is  arbitrarily 
close  to  the  limit  condition.  Such  narrowing  of  the  gap  between  normal,  limit 
conditions  and  abnormal,  omega  conditions  wiil  require  establishment  of  a 
new  interface  between  structural  and  non- structural  systems.  Positive 
procedures  must  be  established  to  control  operations  to  insure  that  the 
operational  limitations  are  not  violated  to  the  eixtent  that  an  omega  condition 
is  attained  by  the  vehicle.  The  narrower  the  gap  between  the  limit  and  omega 
conditions,  the  more  stringent  must  be  the  control  of  the  operations. 

Assuming  that  any  reduction  in  the  required  design  factors  is  not  to  be 
acconplished  by  reducing  the  structural  reliability  goal,  the  Test  Factors  of 
Safety  given  In  Figures  12,  20,  24  and  25  present  the  key  to  possible  weight 
reductions.  In  every  case,  the  TFS  required  for  a  given  S.R.  goal  can  be 
reduced  by  reducing  the  strength  scatter,  7  ,  of  the  structure.  Typically, 

the  1.5  FS  used  in  the  past  has  effectively  covered  the  limit  TFS  requirement. 
As  the  ratio  between  limit  and  omega  conditions  Is  reduced,  the  Lindt  TFS  will 
become  controlling.  At  this  point  any  further  effort  expended  in  controlling 
operational  overloads  would  be  futile  unless  the  Limit  TFS  could  be  reduced  so 
that  lees  proviaion  against  underetrength  is  needed.  Besides  the  option  to 
reduce  the  Lindt  TFS  by  reducing  the  strengtn  scatter,  the  designer  could 
reduce  the  Limit  TFS  by  conducting  multiple  strength  tests  as  indicated  in 
Figure  25.  All  of  this  provides  a  rational  means  to  justify  the  use  of  reduced 
design  factor#  provided  it  is  feasible  (l)  to  rol  overloads,  (2)  to  reduce 
the  strength  scatter,  and  (3)  to  conduct,  nltiple  strength  tests. 
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The  description  of  the  new  procedure  to  this  point  has  been  concerned 
with  time-independent  (static)  strength  situations.  A  complete  quantitative 
structural  design  criteria  by  statistical  methods  must  consider  time-dependent 
(fatigue)  strength  situations.  The  basic  approach  for  fatigue  follows  the 
same  philosophy  developed  for  the  static  situation.  Only  the  details  are 
deferent.  However,  implementation  of  this  basic  approach  requires  the 
adoption  of  a  new  concept  of  the  failure  mechanism  in  fatigue. 

Residual  strength  rather  than  life  is  treated  as  the  significant  parameter 
in  fatigue  situations.  In  the  static  case,  the  probability  of  failure  is  a 
function  of  the  strength  of  an  individual  structure  being  exceeded  by  a  load 
sometime  during  the  life  of  the  vehicle.  In  the  fatigue  case,  the  same  con¬ 
siderations  govern.  During  any  given  time  period  in  the  life  of  the  vehicle, 
the  probability  of  failure  is  a  function  of  the  residual  strength  at  that 
time  ond  the  probability  that  the  loads  experienced  during  the  period  will 
exceed  the  residual  strength.  This  is  identical  to  the  static  problem  except 
that  the  period  of  time  for  which  the  strength  can  be  considered  unchanged  is 
much  shorter.  There  is  a  scatter  in  the  strength  at  any  given  time.  Just  as 
in  the  static  case.  The  only  difference  between  the  static  and  fatigue 
situation  is  that  the  ^san  residual  strength  and  t.i.o  aoautxaied  scatter  in 
residual  strength  vary  from  one  time  period  to  the  next.  The  lifetime 
probability  of  failure  is  simply  the  integration  of  the  probability  of  failure 
in  each  separate  period  from  the  beginning  to  the  end  of  the  service  life  of 
the  vehicle. 

The  new  procedure  assumes  that  the  fatigue  analysis  is  characterized  by 
the  same  type  of  difficulties  as  the  static  problem.  No  matter  what  fatigue 
theory  is  used,  it  is  expected  that  there  will  be  as  many  or  more  occasions 
when  the  analysis  does  not  correspond  to  the  actual  results  as  there  have  been 
for  the  static  case.  Therefore,  a  probability  of  failure,  calculated  on  the 
basis  of  a  no-error  assumption,  would  be  incorrect  as  discussed  in  Section  2. Id. 
Any  reasonable  assumption  of  the  error  function  in  fatigue,  comparable  to  that 
shown  on  Figure  5  for  the  static  case,  would  result  in  the  determination  of  an 
unacceptably  low  S.R. 

The  fatigue  teat  performs  the  same  function  as  the  static  test  in  dis¬ 
closing,  by  premature  test  failure,  that  there  is  an  error  in  the  analysis. 

The  subsequent  redesign  and  retest  upgrades  the  S.R.  Just  as  the  static  test 
does.  The  problem  is  aggravated,  however,  by  the  large  scatter  in  time  of 
failure  as  illustrated  by  Figure  .31.  In  general,  a  fatigue  test  doe3  not 
disclose  the  errors  with  as  liigh  a  degree  of  certainty  ae  In  the  corresponding 
static  situation.  However,  the  computer  program  described  in  Volume  III  can 
determine  the  teat  life  required  to  meet  any  given  reliability  goal.  The 
test  life  for  various  types  of  fatigue  test  can  be  determined  as  shown  on 
Figures  38  and  39.  Tills  factor  on  the  service  life  is  analogous  to  the  static 
Test  Factor  of  Safety  shown  on  Figures  12  and  24. 

c.  Verification  of  Loads  and  Design  Conditions 

In  addition  to  the  necessity  for  strength  tests  to  disclose  error  in  the 
strength  analysis,  other  tests  are  needed  to  verify  the  S.R.  level  attained  in 
operation.  Doth  the  static  and  fatigua  tests  are  conducted  to  loads  determined 
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analytically  for  the  specified  operational  conditions.  These  loads  must  be 
verified  by  flight  and  ground  load*  tests.  Such  tests  would  not  represent  any 
difference  between  the  new  procedure  and  the  Present  System  except  for  the 
problem  of  verifying  tne  omega  condition  loads.  This  is  discussed  in  Section 
2.3*. 


liven  if  the  structure  has  exactly  the  strength  it  was  intended  to  have 
and  even  if  the  loads  are  absolutely  correct,  the  actual  structural  reDiability 
attained  in  service  will  not  necessarily  correspond  to  the  S.R.  goal.  If  the 
limit  and  omega  conditions  are  encountered  more  often  than  was  expected  when 
these  conditions  were  established  as  design  conditions,  the  S.R.  will  be 
lower  than  desired.  Once  a  vehicle  with  a  structural  system  having  a 
particular  strength  level  ie  accepted  and  placed  in  service,  the  S.R.  can  be 
controlled  by  controlling  the  operations  so  they  conform  to  the  initially 
predicted  operations.  This  can  be  accomplished  by  monitoring  tne  actual 
operational  results  and  comparing  with  the  prediction  used  in  choosing  the 
limit  and  omega  conditions.  This  monitoring  can  be  accomplished  in  several 
ways.  Single  reporting  of  the  occurrences  when  the  operational  limitations 
were  exceeded  ie  one  way.  Instrumented  operations  such  as  providud  by  an 
eight-  channel  recorder  Is  another.  It  does  not  take  an  actual  occurrence  of 
an  omega  condition  to  decide  that  the  operations  are  being  conducted  in  a  more 
severe  fashion  than  anticipated.  Section  2.3g(3)  describes  some  of  the 
appropriate  procedures  for  "proving"  that  operations  are  compatible  with  the 
available  strength  in  the  structural  system,  as  fabricated.  A  USAF  contract ^3 
has  developed  a  computer  program  that  will  print  appropriate  warnings 
whenever  the  operational  usage  is  mors  severe  than  it  should  be.  After  a 
warning,  the  operations  should  be  modified  to  reduce  their  severity  so  that 
the  available  structure  can  continue  to  be  used.  Alternatively,  it  may  be 
decided  t,o  change  tha  initial  decision  on  the  required  etructural  performance 
mud  to  increase  the  structural  requirements  to  match  the  actual  operations. 
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5.4  SUMMARY 

The  steps  in  the  new  procedure  can  be  summarized  as  follows: 

(1)  Establish  a  structural  reliability  goal  consistent  with  the  mission  of  the 
vehicle.  Table  I  values  are  suggested.  The  S.R.  goal  eerves  as  the  basis 
for  the  subsequent  requirements,  but  the  S.R.  goal  itself  is  not  designated 
as  a  requirement. 

(2)  Choose  limit  and  omega  design  conditions.  These  should  be  based  on  the  S.R. 
goal  as  indicated  on  Table  I.  If  the  necessary  statistical  data  are  not 
available,  qualitative  considerations  may  be  used  as  the  basis  for  the 
choice.  A  limit  condition  should  be  a  normal  or  ejected  operational  con¬ 
dition,  Where  appropriate,  it  will  correspond  to  an  operational  limitation 
of  the  vehicle.  As  such,  it  corresponds  to  the  limit  condition  in  the 
Present  System.  The  omega  condition  should  be  an  abnormal  cper&tiw.ial  con- 
di*ion,  cue  reached  only  as  the  result  of  an  error  in  operation  or  in  the 
functioning  of  a  non-structural  system.  The  omega  condition  represents  the 
upper  bound  of  any  required  structural  capability.  If  the  structure  should 
fail  due  to  operations  beyond  omega,  it  has  effectively  been  predetermined 
that  the  operational  problem  should  be  corrected  rather  than  that  the 
structural  system  should  be  modified  to  tolerate  the  operational  error. 

(3)  The  structural  system's  performance  requirement  is  based  on  statistical 
considerations.  However,  the  intention  of  the  requirement  is  to  define  a 
structural  system  that  will  never  fail  at  a  limit  condition,  a  system 
which  will  usually  survive  the  omega  condition  and  a  Bystem  which  is 
expected  to  fail  beyond  the  omega  condition. 

(4)  The  basic  design  is  qualified  and  approved  in  much  the  same  fashion  as  in 
the  Present  System.  Analytically,  the  allowable  strength  of  the  structure 
must  be  equal  tc  or  higher  than  the  loads  corresponding  to  the  limit  condi¬ 
tion  loads  multiplied  by  the  Limit  Test  Factor  of  Safety  presented  on 
Figures  24  and  25.  As  a  separate  and  distinct  requirement,  the  allowable 
strengtn  of  the  structure  under  the  omega  conditions  must  be  equal  to  or 
higher  than  the  loads  corresponding  to  the  omega  loads  multiplied  by  the 
Omega  Test  Factor  of  Safety  presented  on  Figures  12  and  20.  For  fatigue 
situations  the  structure  must  be  designed  to  survive  to  a  multiple  of  the 
nominal  life  as  defined  by  Figures  38  and  39. 

(5)  As  in  the  Present  System,  the  strength  analysis  must  be  verified  by  strength 
tests.  In  the  static  cases.  Figures  12,  20,  24  and  25  define  the  test  loads. 
In  the  fatigue  cases.  Figures  38  and  39  define  the  fatigue  test  duration. 

(6)  Design  loads  in  the  new  procedure  must  be  verified  much  as  in  the  Present 
System. 

(7)  Service  operations  should  be  monitored  by  procedures  discussed  in  Section 
2.3g(3)  to  determine  that  the  operations  are  consistent  with  the  design 
limit  and  omega  conditions.  If  not,  either  the  operations  must  be  changed 
to  make  them  consistent  with  the  design  conditions,  the  structure  must  be 
changed  to  be  consistent  with  the  actual  operations,  or  the  structural 
reliability  goal  must  be  changed. 
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SECTION  VI 


DEMONSTRATION  OF  THE  STRUCTURAL  DESIGN  CRITERIA  METHOD 

USING  F-lOO  DATA 


6.1  GENERAL 

The  new  procedure  developed  in  this  report  for  defining  statistically- 
based,  deterministic  structural  design  criteria  is  applied  to  the  F-lOO 
airplane.  This  airplane  is  a  modem  service  aircraft  that  has  enjoyed  volume 
production  and  wide  service  usage.  Comprehensive  records  documenting  the 
design  parameters  and  the  operational  rscord  o.  this  airplane  are  available. 
Accordingly,  ths  F-100  represents  an  excellent  vehicle  for  demonstrating  the 
new  procedure. 

6.2  BACKGROUND  INFORMATION 

a.  F-lOO  History 

The  F-100,  used  as  tha  model  for  this  demonstration,  has  bean 
produced  in  quantity  through  four  different  models  and  has  bean  in  the  Air 
Force  inventory  for  over  12  years.  F-100  squadrons  are  currently  engaged  in 
the  Vietnam  war  where  they  have  beai  deployed  at  several  different  air  bases 
since  October  of  1964 . 

The  F-lOO  engineering  design  effort  began  on  the  prototype  "Sabre  45"  as 
a  company-sponsored  program  on  January  19,  1951.  On  May  14,  1951,  North 
American  proposed  to  the  Air  Force  to  construct  two  Sabre  45  air  superiority 
fighters  to  provide  early  combat  availability  of  production  airplanes.  The 
first  letter  contract  for  two  prototypes  was  issued  November  1,  1951.  CH 
December  7,  1951,  the  Air  Force  officially  designated  the  Sabre  45  the 
F-100A.  The  first  production  contract,  January  25,  1952,  was  for  23  F-1Q0A 
airplanes,  one  static  test  article,  spare  parts,  etc. 

The  YF-100  airplane  was  first  flown  on  May  25 ,  1953 >  and  exceeded  the 
speed  of  sound  in  level  flight.  Tha  last  production  F-100F  was  mads  in 
Septentoer  1959.  By  February  1959  more  than  7174  flights,  totaling  over  4907 
houre,  had  been  made  by  NAA  engineering  test  pilots. 

b.  Structural  Design  Criteria  and  Operating  Limitations 

The  F-100  is  a  Class  II  day  fighter  with  fighter  bomber  capabilities. 

It  has  a  level  flight  high  speed  of  Mach  1.35  at  the  optimum  altitude  of 
35,000  feet  ard  a  service  ceiling  of  55,000  feet.  The  25  percent  chord  lines 
of  all  lifting  surfaces  are  swapt  back  45  degrees.  The  flight  eontrol 
surfaces  art  all  actuated  by  irreversible  hydraulic  boost  systems.  It  is 
powered  by  a  Pratt  and  Whitney  axial-flow  turbojet  engine  with  afterburner 
( J-57-21) .  The  landing  gear  is  a  conventional  tricycle  type  equipped  with 
air-oil  shook  struts.  The  A,  C,  and  D  models,  single  place,  were  designed  to 
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USAF  Specification  .C-1803,1^  and  the  F  model,  two  place,  to  Military 
Specification  MIL-S-5700.20  This  means  the  F-100  design  is  based  on  the 
procedures  of  the  Present  System  with  a  Factor  of  Safety  as  designated  in  the 
specification  and  with  no  requirement  to  achieve  a  quantitative  structural 
reliability  number.  Also,  there  was  no  requirement,  to  survive  a  specified 
number  of  service  hours. 

The  structural  design  limit  load  factors,  gust  velocities  and  landing 
sink  speeds  are  shown  in  Tables  III,  IV,  and  Figures  57,  58,  59  and  60. 


TABLE  III 

MANEUVER  LOAD  FACTORS 


Applicable  Weight  Condition 

Symmetrical 

Unsymmetrical  | 

Pos. 

Neg. 

Pos. 

Neg. 

Weights  equal  to  or  lass  than  the 
structural  design  gross  weight 
without  external  stores 

7.33 

3.00 

4.88 

1.00 

Weights  greater  than  the  structural 
design  gross  weight  and  all  weights 
with  external  stores 

6.00 

2.00 

k  .00 

1.00 

Equivalent  gust  velocity  of  50  fps  up  to  V^.  Landing  sink  speed  A,  C,  D 
models  v8  =  12  fps  ultimate  with  energy  requirement  of  0.9  (n-1)  Wj. 
Landing  sink  speed  for  F  models  v8  =  9  fps. 


TABLE  IV 

LANDING  LOAD  FACTORS 


Applicable  Weight  Condition 

Main  Gear 

Nose  Gear 

Landing  Groes  Weight 

3-0 

3.0 

Take-off  Grcee  Weight 

2.0 

2.0 

As  noted,  there  was  no  contract  requirement  for  a  specified  number  of 
hours  on  airplane  service  life.  However,  as  an  outgrowth  of  F-86  experience, 
the  unofficial  F-100  figure  used  at  the  time  of  design  was  2000  hours.  Elements, 
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parts,  and  assemblies  in  the  design  development  phase  of  the  program  were 
tested  cyclically  to  constant  load  levels.  Usually  the  tests  were  considered 
complete  at  3000  hours,  which  is  related  to  the  30  percent  safety  factor. 

There  was  no  concerted  effort  to  design  the  airplane  for  a  certain  number  of 
hours;  however,  there  was  a  conscientious  awareness  of  good  engineering 
practice  to  avoid  stress  risers  and  fatigue-prone  structures. 

The  following  charts  illustrate  the  design  and  operating  envelopes  of  the 
airplane.  The  speed-altitude  profile,  Figure  57,  depicts  the  flight  envelope 
of  the  airplane.  These  design  values  have  been  verified  in  numerous  flight 
test  programs  over  the  years  and  more  recently  by  Air  Force  energy-maneuverability 
studies  wherein  comparisons  are  made  with  contemporary  airplanes.  The  V-n 
diagrams,  Figures  58  and  59,  are  typical  of  these  used  for  structural  design 
at  two  altitudes.  The  operating  flight  limits  for  each  letter  model  in  the 
fleet  are  displayed  in  Figure  60. 

c.  Structural  Integrity  Tests 

The  flight  test  programs  on  the  F-100  airplanes  were  very  comprehensive. 

In  addition  to  the  customary  tests  on  stability  and  control,  performance, 
power  plant,  dives,  etc.,  the  structural  integrity  of  each  letter  model  was 
demonstrated  in  flight.  As  a  supplement  to  this,  the  flight  loads  were 
measured  on  a  specially  instrumented  airplane.  The  maximum  service  limits  on 
airspeed,  control  usage,  and  load  factor  were  established  by  these  structural 
demonstrations  and  flight  loads  programs. 

Complete  airframe  static  tests  were  performed  au  the  Contractor's  plant 
on  the  F-100A.  Static  tests  of  significant],’  changed  components  for  each 
succeeding  letter  model  were  acconplished  as  they  were  introduced  into  pro¬ 
duction.  Extensive  structural  testing  of  fittings  and  components  for  both 
static  and  repeated  loadings  were  a  vital  part  of  the  design  development 
cycle  of  the  airplane.  A  complete  airframe  laboratory  fatigue  test  for  a 
5500  hour  service  life,  which  is  part  of  an  AF  Structural  Integrity  Program, 
is  presently  being  accomplished  at  the  Contractor '3  plant.  A  failure  in  the 
wing  root  occurred  at  1674  hours.  It  should  be  noted  that  the  ASIP  studies 
later  shewed  the  loading  spectrum  used  in  the  test  to  be  too  severe.  As 
discussed  in  Section  6.4d  a  revised  spectrum  was  established  on  Figure  75  and 
the  tests  were  resumed.  Another  test  was  conducted  on  a  wing  that  had 
accumulated  a  significant  number  of  operational  hours  before  the  test.  An  F-100 
T-Sird  Solo  airplane  (serial  # 55-2724)  experienced  a  mid-air  collision 
January-February  1963  wherein  the  wing  sustained  minor  damage.  This  wing, 

.'Table  IX,  No.  1,  had  1080  flight  hours  in  the  T-Bird  fleet,  when  it  was  replaced 
and  later  returned  to  the  contractor.  As  discussed  in  Section  6.4b,  the  load 
factor  spectrum  of  the  "Th underbird"  aircraft  is  more  severe  than  that  experienced 
in  normal  service  operation.  On  January  31,  1967,  this  T-Bird  wing  sustained  150 
percent  of  the  maximum  design  limit  condition  in  a  static  test  as  a  part  of  the 
ASIP  at  the  contractor's  plant. 

The  following  values  for  F-100  allowable  limit  load  factors  and  load  at 
key  points  (Table  V)  have  been  verified  by  comprehensive  structural  testing, 
both  in  flight  and  in  the  laboratory  over  the  years. 
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M-N,  Q-N  DIAGRAM  AT  25,000  FEET  (7620  KILOMETERS) 
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FIGURE  60.  F-100  OPERATING  LIMITS 
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TABLE  V 


ALLOWABLE  LIMIT  BENDING  MOMENTS 


Item 

Location 

Banding  Moment*  1 
(10)6  in-lbs  | 

«x 

Wing  Root 

B.P.  21. 

8.0 

Wing  Mid  Span 

Sta.  145 

2.73 

Hor.  Tail  Root 

Sta.  29 

0.64 

Ver.  Tail  Root 

Fus.  Sta.  465  W.P.  20 

0.6 8 

Fus.  Fwd 

ISO 

1.86 

1.25 

Fua.  Rear  Spar 

310 

8.85 

2.58 

Fus.  Field  Br'k 

369 

5.4? 

2.08 

*Note  -  The  Fuselage  B.M.  are  not  simultaneous 


P-100  SCNGLE  LOAD  PATH  POINTS 
(Possibly  Fatigue  Critical) 

Wing  -  fuselage  splice  Joint,  fillet  radius  in  cover  plate  at  root  rig 
diagonal  spar. 

Horizontal  tail  cover  plate  attach  at  heavy  yoke  pipe  tie  across  fuselage. 
Fuselage  field  break  point. 

Vertical  tail  main  bean  coat  hanger  fitting. 

Main  gear  -  axle  and  upper  trunnion 

Nose  gear  -  upper  drag  brace  link,  integral  cylinder  for  deem  lock.  Not 
serious  after  crack  develops. 

6.3  STRUCTURAL  FAILURE  DATA 

a.  Maintenance  Records 

In  an  effort  to  utilize  all  available  information,  an  attempt  was  made 
to  incorporate  A f  66-1  Maintenance  Data  u  the  determination  of  the  strength 
distribution.  A  i epreeentative  tap^1  c  ntaining  P-100  aircraft  maintenance 
records  for  three  Boothe  of  operation  (January-March,  1965)  was  used. 
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The  procedure  wee  to  first  sort  out  primary  structural  iteaa  on  the 
aircraft.  Using  these  data,  &  second  sort  was  made  to  eliminate  types  of 
malfunctions  not  pertinent  to  structural  failure,  i.e.,  electronic  equipment 
malfunctions,  engine  failure,  etc.  The  remaining  data  were  then  sorted  by- 
model  aeries  (D  or  F),  type  of  malfunction,  work  unit  (primary  structural 
item),  aircraft  serial  number,  and  flight  hours  accumulated  by  the  aircraft. 

In  the  three  months  of  data  considered,  a  total  of  168,000  maintenance 
records  had  been  compiled.  Of  these  records,  16,000  were  considered  to  be 
possibly  pertinent  to  primary  structure  malfunction.  Obviously,  the  need 
arises  to  separate  minor  malfunctions  from  critical  failures.  Herein  lies 
the  problem.  As  yet,  no  method  has  been  devised  to  pinpoint  the  relatively 
few  critical  failures  in  the  mass  )f  malfunction  records. 

Table  VI  presents  a  record  of  the  data  on  wing  primary  structure  with 
malfunctions  labeled  broken."  For  the  F-100  D  model,  51  such  records  are 
listed  for  the  three  month  interval,  requiring  roughly  60.4  total  hours  of 
maintenance  for  an  average  of  about  1.2  hours  per  malfunction.  Two  mal¬ 
functions  required  more  than  three  hours  of  maintenance.  Based  on  these 
data,  the  only  obvious  approach  to  the  problem  would  seem  to  be  based  on 
the  hours  of  maintenance  time  required.  This  criterion  hardly  seems  valid 
since  replacement  of  a  critical  piece  of  structure  or  fastener  could  con¬ 
ceivably  require  only  a  matter  of  minutes.  Other  approaches  based  on  "action 
taken"  codes  and  "when  discovered"  codes  seam  equally  futile. 

It  is  therefore  concluded  that  a  Judicious  review  of  the  actual 
maintenance  reports  would  be  required  to  isolate  critical  failures  reported 
in  AF  66-1  data.  This  procedure  is  necessitated  mainly  by  lack  of  more 
precise  definition  and  terminology  in  the  AF  66-1  data  coding  system. 

However,  numerous  other  sources  provide  adequate  identification  of 
defici ancles  in  the  structural  components  of  the  aircraft,  among  these  are: 

1.  Ehgineering  Unsatisfactory  Reports,  which  detail  deficiencies 
discovered  generally  by  the  ground  crew  or  during  periodic 
inspect! one. 

2.  Tear-down  Deficiency  Reports,  the  results  of  structural 
components  being  forwarded  to  a  prime  depot  and  torn  down 
for  detailed  failure  analyses. 

3.  Incident  Reports,  in  which  no  major  damage  to  the  aircraft  has 
resulted. 

4.  Accident  Summary  Reports,  filed  in  case  of  major  damage  to, 
or  destruction  of,  the  air  ora  ft. 

Table  VII  presents  a  summary  of  wing- fuselage  ettaoh  bolt  failures. 

Table  VIII  presents  a  sunoaiy  of  in-service  cracks  of  poseibls  fatigue 
origin.  Report  Ho.  DS  65-1  *2  presents  a  deficiency  summary  of  structural 
and  non- structural  eosponentc  of  the  fuselage,  wing,  and  vertical  stabiliser 
of  f-100  aircraft.  These  aumaarlts  have  been  ooapilsd  from  sources  as  listed 
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TABLE  VI 


AF  66-1  MAINTENANCE  DATA  EXAMPLE 

Work  Unit  -  Wing  Prlaary  Structure 
How  Malfunctioned  -  Broken 


Work 

Unit 

Code 

Action 

Taken 

Code 

Ru*ber 

T 

ours  of  Maintenance 

for  Each  Malfunction  ! 

Totals 

of 

Kalf . 

(1) 

(2) 

(3) 

(4) 

(5) 

(6) 

(7) 

(8) 

(9) 

(10) 

11510 

a 

1 

1.0 

1.0 

11511 

G 

4 

0.6 

1.0 

1.0 

0.5 

3.1 

11513 

G 

2 

2.0 

3.0 

5.0 

11515 

G 

10 

3.0 

0.3 

1.5 

0.2 

2.5 

2.0 

0.5 

0.7 

1.2 

6.3 

18.2 

11516 

P 

1 

0.5 

0.5 

G 

3 

1.8 

1.0 

0.5 

3.3 

F 

1 

.0 

.0 

11517 

5 

0.5 

1.0 

1.0 

0.5 

0.3 

3-3 

11518 

3 

0.5 

0.5 

0.5 

1.5 

2 

.0 

0.7 

0.7 

11519 

1 

1.9 

1.9 

8 

4 

0.8 

1.5 

0.7 

0.5 

3.5 

2 

0.4 

2.0 

2.4 

1151A 

8 

1.4 

0.5 

1.0 

0.8 

1.0 

0.6 

1.5 

0.7 

7.5 

1 

2.0 

2.0 

lag 

1 

0.5 

0.5 

1 

6.0 

6.0 

1151B 

B 

1 

.0 

.0 

Totals 

51 

_ 

60.4 

Work  Unit  Code 

Action  Take  Cods 

Structure  (Prlnery) 

(Excluding  shop  woric) 

11510 

11511 

Wing  Assy. 

F 

Repair 

11512 

Center  Section  Assy. 

C 

Repair  and/or  Replacaasnt  (sin or) 

11513 

(Alter  Panel  Assy. 

P 

Renored 

11514 

Spar  Aasy. 

R 

Reaored  and  Replaced 

11515 

leading  Edge 

11516 

Trailing  Edge 

U.517 

Tip  Assy. 

11518 

Skin 

11519 

(Not  otherwise  coded) 

1151A 

Panel  Aasy. 

1151B 

Rib  Assy. 
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TABLE  VII 


WING-FUSELAGE  ATTACH  BOLT  FAILURES 


A/C  Model 

A/C  Hours 

Base 

Problem 

F-IOOD 

56-3006 

2803 

Bion  Hoa 

RH  aft  bolt  broken 

F-100F 

56-3925 

2990 

Bien  Hoa 

RH  aft  bolt  broken 

F-IOOD 

56-3187 

2022 

Rien  Hoa 

RH  aft  bolt  cracked 

F-100F 

56-3775 

2401 

Bien  Hoa 

RH  aft  bolt  cracked 

F-100F 

56-3954 

2668 

Bien  Hoa 

RH  eft  bolt  cracked 

F-IOOD 

56-3372 

2256 

Bien  Hoa 

RH  aft  bolt  cracked 

Ui  aft  bolt  cracked 

F-IOOD 

56-3087 

2660 

Bien  Hoa 

LH  aft  bolt  cracked 

F-IOOD 

56-3383 

2772 

Rian  Hoa 

HH  aft  bolt  cracked 

F-100F 

56-4002 

3054 

Bien  Hoa 

RH  aft  bolt  oracked 

F-IOOD 

56-2914 

Bien  Hoa 

RH  aft  bolt  cracked 

F-100F 

56-39-75 

3044 

Bien  Hoa 

RH  aft  bolt  cracked 

F-IOOD 

55-3618 

2713 

Bien  Hoa 

Bolt  cracked 

F-IOOD 

55-2889 

2530 

Bien  Koa 

Bolt  brokan  end  aft 
attach  bole  oracked 

TABLE  VIII 


IN-SERVICE  CRACKS  (POSSIBLE  FATIGUE  ORIGIN) 


A/C  Serial 
Number 

Date 

A/C 

Hours 

Location,  Size,  Remarks 
(Skin  .fillet  at  root  rib 
and  diagonal  spar) 

55-2724 

F-IOOC 

T-Bird  Solo 

1080® 

Right-hand  lower  8  inches  long. 

55-2723 

F-IOOC 

T-Bird  Solo 

2-17-64 

2569 

Right-hand  and  left-hand  lower 
skins  8  inches  long,  right-hand 
upper  skins  l/4  inch  long. 

55-2724 

F-IOOC 

T-Bird 

2— U 

mm m 

Right-hand  upper  skin  (192-14140) 
crack  length  l/2  inch. 

55-2728 

F-IOOC 

T-Bird 

2-14-64 

2800 

Right-hand  and  left-hand  upper 
skin  (192-14140)  crack  length 

1/2  inch. 

55-2722 

F-IOOC 

T-Bird 

2-17-64 

1661 

Right-hand  upper  skin  (192-14140) 
crack  length  1  l/2  inch. 

55-2874 

F-IOOD 

1-28-66 

2641 

Left-hand  upper  skin  3/8  inch 
long.  223 -14 140 

56-3153 

F-IOOD 

3-25-66 

2547 

Right-hand  upper  skin  3/8  inch 
long.  223-14140 

56-3038 

F-IOOD 

5-16-66 

2425 

Right-hand  upper  skin. 

56-3119 

F-]  OOD 

5-25-66 

2605 

Right-hand  upper  skin. 

54-2075 

F-IOOC 

7-6-66 

2464 

Right-hand  upper  skin  l/8  inch 
long. 

54-2039 

F-10GC 

ANG 

7-23-66 

2570 

Right-hand  upper  skin  two  cracks 
l/l6  inch  long. 

(Continued) 
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TABLE  VIII,  (Continued) 


A/C  Serial 
Number 

Date 

A/C 

Hours 

55-3639 

F-100D 

2-25-66 

2419 

55-3558 

F-100D 

(PACAF) 

1965 

Unkn. 

F-100D 
Unknown 
( French ) 

1964 

Unkn. 

56-3650 

F-100D 

1-22-61 

707 

54-3561 

F-100D 

T~Bird 

3-17-66 

2233 

F-100D 

Prior 

& 

F-100C 

5-6-65 

55-3703 

F-100C 

8-23-66 

1926 

55-3794 

F-100C 

8-23-66 

1943 

55-3708 

F-100D 

T-Bird 

1-3-67 

2764 

56-3098 

F-100D 

Iankee  #1 
Lead-the- 

1-16-67 

2754 

fleet 

. 

Location,  Size,  Remarks 
(Skin  fillet  at  root  rib 
and  diagonal  spar) 

Skin  rabbet  at  root  rib  and  L.E. 
rib  96.  Left-hand  upper  akin 
1  1/2  inch  long.  FS  257 
223-14140 

Rear  spar  main  landing  gear 
trunnion  support. 


Rear  spar  main  landing  gear 
trunnion  support. 


Rear  spar  main  landing  gear 
trunnion  support. 

Fuselage  side  skin  F.S.  315  WL  12. 
Right-hand  side  8  inches  -  10 
inches  long  terminates  at  upper 
longeron. 

65  cracked  upper  NIB  drag  links 
(190-34120),  12  condemned,  349 
aircraft  inspected  and  reworked 
per  T.O.  1F-1QO-964. 

Wing  station  140  near  M.G.  door 
hinge. 

Wing  station  140  near  M.G.  door 
hinge. 

Wing  right-hand  upper  cover  plate 
fillet  radius  at  root  rib  l/8 
inch  long.  This  A/P  entered  the 
T-Blrd  fleet  on  7-16-64  with 
1838  hours. 

Wing  right-hand  upper  cover  plate 
fillet  radius  at  root  rib  3/16 
inch  long. 


Continued) 


TABLE  VIII.  (Concluded) 


A/C  Serial 
Number 

Date 

A/C 

Hours 

Location,  Sise,  Remarks 
(Skin  fillet  at  root  rib 
and  diagonal  spar) 

54-2199 

F-100D 

Vaerloese, 

Den. 

1-31-67 

1669 

Cracked  wing  root  rib  (192-12371) 
at  left-hand  forward  wing-fuselage 
attach  point 

54-2 222 

■ 

i 

2039 

J 

k 

54-2266 

2099 

54-2270 

2052 

54-2274 

206e 

55-2769 

1909 

55-2771 

' 

f 

1628 

' 

i 

55-2779 

F-100D 

Vaerloeee, 

Dan. 

1-31-67 

2098 

Cracked  wing  root  rib  (192-1271) 
at  left-hand  forward  wing-fUaelage 
attach  point. 

55-3520 

F-100D 

T-Bird 

4-5-67 

2600 

No.  2  Solo  T-Bird  A/P.  Cracks 

3  1/2  inches  long  in  lower  surface 
cover  plates  on  both  left  and 
right  wings.  They  begin  at  the 
root  rib  forward  center  radius, 
proceed  on  a  45  degree  angle  for 
one  inch  to  the  first  line  of 
bolts,  then  change  direction  to 
the  rear  and  stop  at  the  second 
line  of  bolts.  This  A/P  entered 
the  T-Birds  on  7-16-64  end  accu»- 
oulated  about  1000  hours  in  the 
squadron. 

<D  Wing  replaced  at  1080  hours,  repaired  at  1338+  hours. 
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above.  Table  II  is  a  special  summary  of  win*  root  skin  fillet  arsa  serrics 
fractures  which  hare  been  dubbed  "Thunderbird"  cracks. 

It  gust  be  concluded  from  this  examination  cf  nelDGananee  records  that 
this  type  of  data  cannot  be  satisfactorily  ..orrelat sd  >/ith  structural 
reliability  predictions.  The  structu.il  reliability  calculations  are  based 
on  catastrophic  failures  during  oper,-.V.c*is  not  t'r/i  m Intivoly  minor  failures 
detected  during  maintenance.  There/ rr«,  data  of  trie  type  will  not  be 
examined  further  in  demonstrating  the  new  preeaduro. 

b.  F-100  Accident  Records 

There  are  voluminous  records  available  wfiic.ii  furrieh  much  information 
on  F— 100  accident  statistics.  ditfortunatvly,  thooi  data  are  not  organised 
in  such  a  fashion  as  to  readily  identity  tho << s  accidents  which  should  be 
classified  ae  structural  fsilursu.  However,  vlth  the  date  Available  ucafiii 
deductions  concerning  the  structural  failure  rule  can  be  axde. 

The  /ollowin£  .F-1C0  Aircraft  Accident  Suaeutiy  report*'  for  the  tire 
periods  listed  arc  available  -it  the  Contrnr.tor  'a  f aclUi;; .  Their  source  is 
the  Direciox*«te  of  Aerospace  Safety,  Sort-on  Air  Force  Ba»e,  California. 

lime  Forlod  Zxsttjjcy  Hz.- 1 


1-1-65  through  12-3! -65 

7~f>6 

1-1-63  through  12- .13 -63 

15-64 

Calendar  year  1961 

7-61 

Calendar  year  I960 

7-61 

7-1-59  through  12-31-59 

3-60 

1-1-59  through  6-30-59 

13-59 

C#iendar  year  3957 

9-58 

1-1-54  through  9-12-55 

39-55 

Tha  following  is  quoted  from  NR  7-66:^-* 

"F-100  Aircraft  (A,  C,  D,  and  Y)  are  active  in  severe!  foreign 
air  forces;  wowever,  this  summary  is  ooncezvied  only  with  those 
poeseseed  by  the  'JSAF  and  the  Air  National  Guard. 

"The  F-100  has  bean  operational  for  over  12  years  and  has 
accumulated  more  than  3,300,000  flying  hours.  There  are 
tactical  units  in  TAC,  USAFE,  PACAF,  ANG,  and  ADC.  The 
Tactical  Air  Consnand  also  provides  rotational  units  to  certain 
overseas  areas.  During  1965,  F-100  combat  crew  training  was 
conducted  by  the  Tactical  Air  Comand  at  Luke  AFi),  Ari aorta.  In 
1965,  as  in  1964«  the  F-100  flew  over  300,000  hours.  These  hours 
encompassed  a  wide  spectrum  of  fighter  activities)  long  over- 
water  flights,  conventional  bombing  and  gunnery  (day  and  night), 
various  types  of  special  weapons  delivery,  student  training,  and  - 
combat  support  In  Southeast  Asia. 
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FATIGUE  CRACKS  -  WING  ROOT  SKIN  FILLET 
"Thunderblrd"  Cracks  -  ASIP 
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"During  it»  operational  life,  the  F-100  has  experienced  933  major 
accidente.  In  spite  of  its  age,  the  F-100  ie  still  the  work  horse  of  the 
tactical  air  forces.  For  this  reason,  and  because  of  its  extended  service  life, 
all  possible  actions  are  being  taken  to  provide  greater  safety  for  the  aircrew. 
Modifications  continually  are  being  made  to  both  airframe  and  engine  to  increase 
reliability.  These  modifications  are  the  result  of  material  deficiences 
identified  by  EUR's,  AFM  66-1  data,  incident  reports,  TDR'e  and  accident  inves¬ 
tigations.  During  1965,  Project  High  Wire  was  completed  on  all  F-lOCD's  and  F's. 
This  program  consisted  of  completely  replacing  all  aircraft  \d.ring  and 
connecting  points.  Some  outstanding  TCTO's  were  accomplished  concurrently. " 


TABLE  X 


F-100  MAJOR  ACCIDENTS 


Year 

Major 

Accidente 

Year 

Major 

Accidents 

Year 

Major 

Accidente 

1953 

0 

1958 

168 

1963 

52 

1954 

4 

1959 

125 

1964 

47 

1955 

22 

I960 

94 

1965 

44 

1956 

70 

1961 

82 

Total  to 

1957 

160 

1962 

65 

1965 

933 

TABLE  XI 

PRIMARY  CAUSE  FACTORS  OF  MAJOR  AIRCRAFT  ACCIDENTS  (F-100) 


Total 

933 

Pilot 

260 

Other  Crew 

0 

Supervision 

35 

Maintenance 

66 

Other  Pereonnel 

19 

Material  Failure 

379 

Airbaee  and  Airways 

LI 

Weather 

2 

Miec.  Unsafe  Cond. 

19 

Undetermined 

140 
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Accident  rates  for  a  eeven-year  period  were  compiled  in  Reference  24. 

The  resulting  graph  is  reproduced  as  Figure  61.  The  flattening  and  possibly 
reversing  trend  of  the  accident  rate  curve  during  the  last  three  years  is 
attributed  to  combat  action  in  Vietnam. 

The  accident  totals  shown  on  Table  X  and  the  accident  rates  shown  on 
Figure  61  are  for  accidents  due  to  all  causes.  The  primary  cause  factors  for 
thess  accidents  is  presented  in  Table  II,  taken  from  Reference  23.  The  379 
accidents  classified  as  material  failure  are  of  particular  concern  to  a 
structural  reliability  study.  Examination  of  the  accident  reports  indicates 
that  less  than  10  percent  of  these  "material  failure"  accidents  represent  what 
is  usually  considered  to  be  a  structural  failure.  Unfortunately,  it  is  not 
possible  to  be  very  precise  in  defining  the  number  of  structural  failures. 

The  best  that  can  be  done  at  this  time  is  to  establish  upper  and  lower  bounds 
for  the  number.  These  bounds  can  be  used  to  validate  the  number  chosen  as  the 
most  logical  value  to  represent  the  number  of  F-100  structural  failures. 

More  than  two  structural  failures  (usually  due  to  excessive  load  factors) 
can  be  documented.  This  represents  0.1  percent  of  the  original  fleet  of  2292 
airplanes  (see  Tabls  XII).  It  must  be  concluded  that  this  represents  the  lower 
bound.  The  379  "materia1-  failure"  accidents  represent  the  upper  bound  and 
about  16  percent  of  the  original  fleet.  All  things  considered,  it  appears  that 
20  failures  is  a  reasonable  number  to  attribute  to  structural  failure.  This 
corresponds  to  a  one-in-ons-hundred  failure  rate.  This  is  considered  to  be 
comparable  to  the  rate  attained  with  6277  F-86  series  airplanes  and  over  12,000 
P-51  aeries  airplanes.  Twenty  failures  will  be  used  in  determining  the  actual 
structural  reliability  of  the  F-100  series.  This  value  in  turn,  will  be  used 
in  the  comparison  with  the  calculated  values  determined  by  the  computer  programs 
as  described  in  Section  6.5. 


c .  Inventory  Data 

In  order  to  determine  the  failure  rate  and  the  structural  reliability  of 
the  F-100  in  service,  either  the  total  numbers  of  vehicles  involved  or  the 
total  number  of  flying  hours  must  be  known.  Table  XII  presents  a  compilation 
of  the  original  and  remaining  inventory  of  F-100  series  airplanes.  Inventory 
data  for  other  century-series  fighters  is  presented  in  Table  XIII  for  compara¬ 
tive  purposes. 

TABLE  XII 
F-100  INVENTOR! 


Model 

Original 

Remaining 

2-1-67 

USAF 

2-1-67 

MAP* 

2-1-67 

F-100 A 

203 

115 

55 

60 

F-100C 

476 

262 

262 

— 

F-100D 

1274 

740 

605 

135 

F-100F 

339 

235 

206 

27 

Total* 

2292 

1352 

1130 

222 
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A  Review  of  the  F-  100’s  for  1966 


III  should  be  of  interest  to  the  using  com 
mands,  as  well  os  to  p  lot  and  mamte 
nance  personnel,  to  know  how  the  F  100  Series 
Airplanes  fared  during  1966  Here  are  some  statistics: 

The  F-100  Series  Airplanes  accumulated  297,455 
hours  dunng  the  year  1966.  This  figure  brings  the 
total  flying  hours  for  the  Century  Birds  to  approxi¬ 
mately  3,786,210  flying  hours  since  their  introduc¬ 
tion  into  the  Air  Force  inventory 


The  F-  100's  are  averaging  over  2500  hours  per 
oirframe,  with  some  airplanes  over  the  3000  hour 
mark  Ahhough  these  figures  moke  pleasant  and  in 
teresting  reading,  other  figures  do  not.  For  instonce, 
in  1966,  F  I  00  Series  Airplanes  were  involved  in  45 
ma|or  accidents,  40  of  which  resulted  in  the  loss  of 
the  airplane.  Fourteen  pilots  lost  their  lives  in  these 
accidents.  Also,  substantially  damaged  airplanes 
represent  a  heavy  work  load  to  repair  activities. 


MARCH  JO.  1N7 


FIGURE  61.  F-100  REV  IS*  -  1966 
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TABLE  XIII 


INVENTORY  OF  OTHER  CENTURY-SERIES  FIGHTERS 
(As  of  1  February  1967) 


Model 

Number 

K-101 

520 

F-102 

743 

F-104 

121 

F-105 

494 

F-106 

282 

F-4 

1126 

It  is  noted  on  Figure  61  that  the  total  fleet  hours  for  the  F-100  eeriee 
airplanos,  einee  their  introduction  into  the  Air  Force  inventory,  is 
3,786,210.  The  distribution  of  these  hours  among  individual  airplanes  of 
the  fleet  in  500-hour  blocks  is  indicated  on  Table  XIV. 


TABLE  XIV 

F-100  LOGGED  SERVICE  HOURS 
(As  of  2  March  1967) 


Hours  Block 

500- 

1000- 

1500- 

2000- 

2500- 

pm. 

1000 

1500 

2000 

2500 

3000 

USAF  Inventory 
(All  letter 
models) 

6 

28 

168 

621 

263 

21 

6.4  LOADS  SPECTRA 

a.  ASIP  Program 

The  United  States  Air  Force  plans  call  for  retention  of  the  F-100  series 
airplanes  on  active  status  well  into  the  1970' b.  These  plans  make  it  very 
obvious  that  the  airplanes  will  be  flown  well  beyond  the  life  expectancy 
anticipated  in  the  original  design  and  development  stages  of  the  structure. 

The  average  F-100  has  2500  service  hours  today.  Consequently,  the  USAF 
contracted  with  North  American  Aviation,  Inc.  to  perform  an  "Aircraft  Structural 
Integrity  Program"  which  will  demonstrate  a  5500  hour  service  life  capability 
for  the  F-100  whan  certein  structural  modifications  are  made  to  the  airframe. 

The  data  collection  for  Phase  I  of  the  Aircraft  Structural  Integrity 
Program  (ASIP)  began  in  Karoh  1966  and  ended  in  August  1966.  Tbs  loads  data 
wore  obtained  from  122  aircraft  equipped  with  statistical  accelerometers. 
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Table  XV  presents  A  detailed  “breakdown  of  these  airplanes  by  model,  tall 
number,  service  hours,  code,  date  instrumented,  and  base  location.  Four  of 
these  airplanes,  code-named  Yankee  #1,  #2,  #3,  and  #4,  were  also  equipped 
with  velocity-load  factor-altitude  (VGH)  instrumentation  and  tape  recorders 
to  measure  bending  moments  on  lifting  surfaces  and  the  fuselage,  and  landing 
gear  loads.  A  sample,  "Pilot's  and  Crew  Chief's  Log"  used  in  gathering  the 
usage  statistics  is  shown.  Figure  62.  The  Phase  I  data,  which  is  used  in 
this  report,  was  based  on  3308  hours  of  statistical  accelerometer  data,  200 
hours  of  VGH  data,  and  113  hours  of  strain  gage  loads.  The  data  are  published 
in  Reference  25 • 

Subsequent  to  the  completion  of  Phase  I  of  the  ASIP,  additional  data  was 
gathered  on  the  F-100  operations,  both  in  peacetime  usage  and  in  combat  in 
Vietnam.  Host  of  the  statistical  analyses  in  the  following  section  are  based 
on  the  Phase  I  data,  but  the  additional  data  are  presented  where  available. 

The  ASIP  airplanes  which  have  been  deployed  to  Vietnam  bases  and  have  engaged 
in  combat  are  listed  on  Table  XVI. 

b.  F-100  Load  Factor  Spectra 

The  load  factor  spectra  used  in  demonstrating  both  the  static  and  fatigue 

25 

structural  reliability  programs  are  from  the  Phase  I  data.  These  data  for 

the  normal  and  lateral  load  factors  are  presented  on  Figures  63  and  64. 

Additional  normal  load  factor  data,  extending  from  the  end  of  Phase  I  to 

May  1967,  have  been  processed  and  are  shown  on  Figure  65  as  peacetime  data. 

The  spectrum  for  the  4322  hours  in  the  extended  period  is  very  little 
different  than  that  for  the  Phase  I  period.  Also,  shown  on  Figure  65  are  the 
combat  usage  data  from  the  airplanes  in  combat  usage  in  Vietnam  as  listed  In 
the  previous  section.  This  combat  usage  data,  although  from  »  relatively 
small  sample,  is  significantly  more  severe  than  the  peacetime  spectra.  It 

26 

will  be  recalled  that  the  load  factor  data  from  the  Korean  war  were  high, 
also,  and  led  to  the  8.67  g  Air  Force  requirement  for  Claes  I  fighters. 

From  the  Phase  I  data.  Figure  63,  it  is  seen  that  the  limit  design  load 
factor  (7.33  g's)  is  exceeded  140  times  every  5500  hours.  This  amounts  to 
0.0254  exceedances  per  hour,  or  one  exceedance  of  limit  every  39.3  flying 
hours.  Since  the  average  flight  duration  is  one  and  two-thirds  hours,  the 
limit  load  factor  is  exceeded  once  every  23 i  flights,  on  the  average. 

The  combat  usage  design  limit  normal  load  factor  spectrum.  Figure  65, 
ehows  that  the  limit  (7.33  g'e)  is  exceeded  550  times  every  5500  hours.  This 
is  equivalent  to  0.10G  exceedances  per  hour,  or  one  exceedance  of  limit 
every  10.0  flying  hours.  Using  the  same  average  time  of  one  and  two-thirds 
hours  for  each  flight,  this  results  in  an  average  limit  load  factor  exceedance 
once  every  6.0  flights  in  the  Vietnam  war.  It  will  be  recalled  that  the  limit 
load  factor  is  one  "...which  establishes  a  strength  level  for  design  of  the 
airplane  and  components  and  is  the  maximum  load  factor  normally  authorized 
for  operations,"  according  to  paragraph  6. 2. 4*4  of  HIL-A-8860. 

The  loading  spectra,  developed  from  the  ASIP  flight  data,  are  maneuver- 
type  spectra  with  the  gust  effects  superimposed.  The  final  load  factor 
spectra.  Figures  63  and  64,  are  a  composite  of  all  bases  except  Nellis  AFB. 
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TABLE  XV 


F-IOO  LEAD-THE-FI£ET  AIRCRAFT 


Code 

Tail  No. 

Hours® 

Date 

Code 

Tail  No. 

Hours® 

Date 

Cannon  AFB 

Homestead 

AFB 

Y1 

56-3098(D) 

2527 

9/65 

X 

55-2884(0) 

2591 

4/66 

Y3 

55-3804(0) 

2213 

3/66 

X 

56-3118(D) 

unavail . 

5/66 

X 

55-381l(D) 

2241 

1/66 

X 

56-3132 (D) 

2508 

4/66 

X 

55-3562(0) 

2389 

3/66 

X 

56-3133 (D) 

2567 

4/66 

X 

56-3993 (F) 

2594 

3/66 

z 

56-2959 (D) 

2600 

4/66 

z 

55-35A5(D) 

2134 

5/66 

z 

56-3009(0) 

2551 

4/66 

z 

55— 3555(D) 

2574 

5/66 

z 

56-3119 (D) 

2583 

4/66 

z 

55-3570(0) 

2240 

5/66 

Z 

56-3320(0) 

2690 

4/66 

z 

55-3574(0) 

1992 

5/66 

z 

56-3121 (D) 

2497 

4/66 

z 

55-3585(D) 

2292 

5/66 

z 

56-3172(D) 

2677 

4/66 

z 

55-3628(D) 

1926 

5/66 

z 

56-3436(0) 

2478 

4/66 

z 

56-2949(D) 

Luke 

AFB 

z 

56-3451(0) 

z 

56-2907 (D) 

Y2 

56-3141(0) 

2574 

9/65 

z 

56-3392(D) 

Y4 

55-3755(0) 

2603 

3/66 

X 

56-2968(D) 

2597 

3/66 

Nellis 

AFB 

X 

56-3140(0) 

2621 

3/66 

X 

56-3879(F) 

2747 

3/66 

Zt 

55-3506(0) 

2057 

4/66 

z 

56— 2955(D) 

2607 

5/66 

zt 

55-3507(D) 

2149 

4/66 

z 

55— 3552(D) 

2044 

5/66 

zt 

55-3520(D) 

2317 

4/66 

z 

56-3072(D) 

2374 

5/66 

Zt 

55-3708(0) 

2235 

4/66 

2 

56-3084(D) 

2564 

5/66 

zt 

55-3759(0) 

2267 

4/66 

z 

56-3093 (d) 

2404 

5/66 

Zt 

55-3776(D) 

2517 

4/66 

z 

56-3818(F) 

2258 

5/66 

Zt 

55-356l(D) 

2270 

4/66 

z 

56-3456(D) 

zt 

55-3582(D) 

2321 

4/66 

z 

56-3038(D) 

Zt 

56-3924 (F) 

2009 

4/66 

z 

56-3065(0) 

z 

56-3110(D) 

Lakenheath  AFB 

Wethersfield  AFB 

z 

55-2809(0) 

2262 

5/66 

Z 

55-36l6(D) 

2201 

5/66 

z 

55-2814(D) 

2157 

5/66 

z 

55-3644 (D) 

2484 

5/66 

z 

55-2817(0) 

1708 

5/66 

z 

55-3663(D) 

2314 

5/66 

z 

55-2826 (D) 

1996 

5/66 

z 

55-3665(0) 

2501 

5/66 

z 

55-2803(D) 

2440 

5/66 

z 

55-3679 (D) 

2393 

5/66 

z 

55-2842(D) 

2270 

5/66 

z 

55-3683 (D) 

2440 

5/66 

z 

55-2852(D) 

2131 

5/66 

z 

55-3690(D) 

2312 

5/66 

z 

56-3203(D) 

1985 

5/66 

z 

56-2964(D) 

2867 

5/66 

z 

56-3214(0) 

2250 

5/66 

z 

56-2983 (D) 

2386 

5/66 

z 

56-323l(D) 

2422 

5/66 

z 

56-3001(0) 

2199 

5/66 

z 

56-3315 (D) 

2276 

5/66 

z 

56-3402(D) 

2113 

5/66 

z 

56-3425 (d) 

2412 

5/66 

z 

56-3434(D) 

2423 

5/66 

(Continued) 
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t.’.BLE  XV.  (Concluded) 


Code 

Tail  No. 

Hours® 

Date 

Code 

Tail  No. 

Hours® 

Date 

X 

England 

56-2344(0 

AFB 

2754 

3/66 

X 

Myrtle  Beach  AFB 

55-3661(0)  2709 

3/66 

X 

56-2989 (D) 

2710 

3/66 

X 

56-3383 (D) 

2736 

3/66 

X 

56-3152(0) 

2506 

3/66 

X 

56-3420(0) 

2749 

3/66 

X 

56—3365 ( D) 

2489 

3/66 

X 

55-3770 (D) 

2808 

3/66 

z 

55-3557(0) 

2112 

4/66 

z 

55-°877(D) 

2296 

4/ 66 

z 

55-2793(0) 

2033 

4/66 

z 

55-2900(D) 

2138 

4/66 

z 

55-2860(D) 

2801 

4/66 

z 

55-29A9(D) 

2345 

4/66 

z 

55-2912(D) 

2318 

4/66 

z 

56-3357(D) 

2456 

4/66 

z 

55-2919(D) 

55-2923(0) 

2362 

4/66 

z 

56-3356(0) 

2484 

4/66 

z 

2568 

4/66 

2 

56-3360(0) 

2418 

4/66 

z 

55-2929(D) 

2364 

4/ 66 

z 

56-3372(0) 

2240 

4/66 

z 

56-2952(D) 

2465 

4/66 

2 

56-3379(0) 

2557 

4/ 66 

z 

56-2956(0) 

2535 

4/66 

z 

56-3381(D) 

2504 

4/ 66 

z 

55-3704(D) 

2488 

4/66 

Z 

56-3384 (D) 

2541 

4/66 

z 

55-3709(0) 

2707 

4/66 

z 

56-3385(0) 

2319 

4/66 

z 

55-3741(0) 

2126 

4/66 

z 

56-3413(0) 

2502 

4/66 

z 

55-3739(0) 

2341 

4/66 

z 

56-3415(D) 

2415 

4/  66 
4/66 

z 

55-3757(D) 

2169 

4/66 

z 

56-3435 (D) 

2382 

z 

55-3774(D) 

2541 

4/66 

z 

56-3459(D) 

2272 

4/66 

z 

55-')797(D) 

2729 

4/66 

z 

56-3462 (D) 

2543 

4/66 

z 

56-v087(D) 

2669 

4/66 

z 

56-3071(0) 

2409 

4/66 

z 

56-3167(D) 

2143 

4/66 

z 

56-3073(0) 

2447 

4/66 

z 

z 

z 

56-3173(0) 
56-2927 (D) 
55~2874(D) 

2546 

4/66 

©Airplane  houre  when  instrumented 


LEGEND 

X  *=  X-Ray  A/P 
Y  *=  Yankee  A/P 
Z  *-  Zulu  A/P 

Zt  *=  Zulu  (Thunderbird)  A/P 
(D)«=  F-100D 
(F)*=  F-100F 
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TABLE  XVI 


F-100  AIRCRAFT  STRUCTURAL  INTEGRITY  PROGRAM  AIRPLANES 
DEPLOYED  TO  VIETNAM  WAR  BASES 

(Flight  and  combat  hours  for  pariod  1  September  1966  to  28  Fabruary  1967) 


Code 

Tail  No. 

Flights 

Combat 

Hours 
of  Data 

Cj 

so 

e! 

Remarks  8 

z© 

55-2793 

32 

102.2 

51.7 

24  Nov  66 

Z 

55-2860 

30 

129.1 

41.1 

19  Dec  66 

S.A.  Malf.® 

Z 

55-2877 

42 

168.3 

73-9  I 

17  Nov  66 

z 

55-2884 

11 

38.6 

24.5 

8  Oct  66 

Homestead  AFB 

Z 

55-2900 

45 

253.8 

72.7 

31  Jan  67 

z 

55-2912 

49 

134.8 

74-5 

30  Nov  66 

Lost  3-20-67 

z 

55-2914 

9 

28.9 

15.9 

22  Nov  66 

z 

55-2923 

39 

94.2 

62.3 

15  Nov  66 

S.A.  Malf. 

z 

55-2929 

27 

88.5 

42.6 

14  Nov  66 

S.A.  Malf. 

z 

55-2949 

40 

250.1 

68.6 

1  Feb  67 

S.A.  Malf. 

z 

55-3557 

35 

73.4 

65.6 

24  Nov  66 

S.A.  Malf. 

X® 

55-3661 

26 

114.0 

42.4 

20  Jan  67 

S.A.  Malf.  (Last  2 

z 

55-3704 

29 

146.0 

48.3 

25  Nov  66 

Flights) 

z 

55-3709 

37 

166.9 

60.5 

26  Nov  66 

z 

55-3741 

4 

23.3 

12.6 

31  Oct  66 

z 

55-3757 

37 

146.3 

59.7 

27  Nov  66 

S.A.  Malf. 

z 

55-3774 

34 

52.9 

12  Jan  67 

z 

55-3797 

5 

6*4 

6.4 

19  Sep  66 

S.A.  Malf. 

z 

z 

56-2907 

56-2927 

26 

153.9 

49-6 

22  Nov  66 

Lost'  12-15-66 

X 

■56-2944 

5 

24.8 

7.6 

1  Oct  66 

Uncertain 

z 

56-2952 

21 

39.5 

26.7 

2  Nov  66 

S.A.  Malf. 

56-2956 

56-2989 

38 

153.8 

68.3 

8  Jul  66 
13  Dec  66 

Lost  9-27-66 

56-3071 

17 

26.1 

26.1 

12  Sep  66 

Lost  9-13-66 

56-3073 

81 

168.1 

121.5 

1  Dec  66 

S.A.  Malf. 

56-3087 

40 

102.6 

66.5 

24  Nov  66 

56-3152 

2 

4-5 

2.8 

8  Sep  66 

z 

56-3167 

7 

12.7 

12.7 

19  Oct  66 

Lost  10-26-66 

z 

56-3173 

39 

132.9 

60.4 

24  Nov  66 

X 

56-3365 

20 

120.9 

25.6 

10  Dec  66 

z 

56-3372 

11 

116.5 

16.8 

30  Oct  66 

S.A.  Malf. 

z 

56-3379 

69 

152.4 

107.8 

19  Dec  66 

z 

56-3381 

20 

115.6 

37.6 

4  Nov  66 

X 

56-3383 

85 

177.7 

124.6 

28  Jan  67 

S.A.  Malf. 

z 

56-3384 

2 

109.1 

44.4 

24  Oct  66 

S.A.  Malf. 

z 

56-3385 

12 

26.5 

i  18.8 

8  Nov  66 

z 

56-3413 

145 

263.1 

216.7 

31  Jan  67 

S.A.  Malf. 

z 

56-3415 

43 

211.7 

67.5 

26  Jan  6? 

S.A.  Malf. 

z 

56-3435 

44 

124.7 

68.2 

31  Oct  66 

S.A.  Malf. 

z 

56-3462 

6 

83.3 

9.4 

26  Nov  66 

z 

z 

28 

64.3 

49.6 

7  Dec  66 

Lost  7-21-66 

■k@i*mi93iQn 

HS££mB 

■■■■■ 

■■■■■ 

■■■■■ 

^^rg^"T^^",,^^atStTc!^™Jxc9T?romete^^uT^SctC? 

©F-100  Viatnam  combat  usage  la  averaging  55  hours  per  month  par  airplane 
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CIMULATIYE  FREQUESCY  OP  OCCURRiiSCES  PER  5500  HOURS 


PROBABILITY 


CUMULATIVE  FREQUENCY  OF  OCCURRENCES  PER  5500  HOURS 


L5 


The  reaeon  for  this  ia  that  the  "Th underbirds"  are  baaed  at  Nellie  and  these 
data  are  considered  demonstrations!  and  not  representative  of  normal  service 
operation.  The  Thunderbird  data  have  been  added  to  Figure  65  for  comparison. 

A  least  squares  method  was  used  to  fit  the  raw  data  to  a  truncated 
distribution  curve  of  the  form: 


(2<  x  <®) 

where  T  ■=  load  factor  exceedances 

X  ■=  load  factor 
a,k  *=  constants 

This  procedure  provides  a  means  of  fitting  a  smooth  curve  to  each  spectrum 
and  provides  a  mathematical  description  of  areas  of  the  spectrum  where  sample 
data  else  does  not  provide  a  good  description. 

The  data  for  the  various  missions  were  classified  into  the  categories 
of  Air-to-Air  Gunnary,  High  Angle  Boobing  and  Low  Angle  Bombing.  The  spectra 
for  these  categories  are  shown  on  Figure  66.  They  can  be  compared  with  the 
composite  spectra  on  Figure  65.  Only  the  compoeite  spectra  are  used  in  the 
analyses  presented  in  this  report  although  it  would  be  necessary  to  synthesize 
the  spectrum  from  data  on  the  various  categories  when  predicting  a  spectrum 
for  initial  design. 

c.  F-100  Loads  Correlation 

A  flight  loads  survey  was  performed  to  obtain  loads  at  the  design 
limit  conditions.  A  matrix  of  altitudes  and  Mach  numbers  were  flown  at  the 
design  limit  load  factors  to  search  out  the  critical  loading  conditions.  The 
results  of  this  program  showed  that  the  maximum  measured  wing  loads  exceeded 
the  design  calculated  critical  condition  by  six  percent.  The  mum  measured 
horiaontal  tail  loads  were  only  75  percent  of  the  critical  design  value.  The 
maximum  measured  vertical  tail  loads  occurred  during  rolling  pullout  maneuvers, 
but  thoy  turned  out  to  be  two  percent  less  than  the  design  load  value  from  a 
rudder  condition.  Other  structural  demonstration  programs  and  specialized 

engine*,  flight  teats  for  store  loads  and  ejection*,  where  selected  airframe 

components  and  surfaces  were  instrumented  with  tip  targets  and  calibrated  strain, 
gages  tj.:i»d  to  confirm  these  findings. 

The  Aircraft  Structural  Integrity  Program,2'*  wherein  the  airplanes  were 
instrumented  with  bending  moment  strain  gages  and  flown  at  twice  the  normal 
usage  rate,  showed  that  the  major  mission  profiles  were  subsonic  at  low 
altitudas  (10  to  15,000  feet)  and  with  external  stores.  As  such,  these  condi¬ 
tions  were  all  lees  than  the  critical  design  and/or  measured  values.  However, 
the  same  trends  appear  with  respect  to  relative  load  levels.  The  wing  loads, 
although  less  than  design,  were  more  closely  allied  with  the  normal  load 
factors  at  levels  below  the  design  limit  value.  At  limit  load  factor,  and 
i  bore,  the  wing  bending  moment  trend  with  load  factor  drops  off  because  of  the 
inboard  movement  of  the  center  of  pressure  at  high  angles  of  attack.  These  trends 
are  illustrated  graphically  on  the  percent  of  limit  spectrum.  Figure  67.  The 
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CUMULATIVE  FREQUENCY  OF  OCCURRENCES  PER  1000  HOURS 
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FIGURE  69.  SENDING  HGKBfT  -  LOAD  FACTOR  CORRELATION 


vertical  tail  loads  from  operational  usage  in  comparison  to  design  strength. 
Figure  68,  are  so  low  as  to  be  in  the  noise  level.  The  horizontal  tail  loads 
as  reflected  in  the  fuselage  moments  are  also  well  below  design  strength 
values.  Figure  67. 

A  graphical  illustration  of  the  correlation  of  the  wing  root  bending 
moment  with  airplane  c.g.  load  factor  is  shown  on  Figure  69.  The  calculated 
least  squares  solution  for  mean  line  and  standard  error  diepersion  lines  is 
shown.  It  is  assumed  that  the  data  in  each  load  factor  level  are  normally 
distributed.  The  3 <r  lines  define  boundariee  which  contain  99*7  percent  of  the 
data  for  large  samples.  This  definition  of  dispersion  is  considered  adequate 
for  the  extreme  values  of  load  factor.  Bending  moment  occurrences  in  each 
load  factor  interval  are  established  for  the  total  number  of  load  factor 
occurrences  in  that  interval  as  obtained  from  the  extrapolated  5500  hour  load 
factor  spectrum.  Summing  these  occurrences  for  each  bending  moment  interval 
defines  the  frequency  distribution  of  the  largest  to  the  smallest  bending 
moments  for  the  loading  spectra.  Tabulated  data  for  the  correlation  are 
presented  in  Table  XVII  for  data  obtained  from  the  Phase  I  ASIP  program. 
Comparable  data  from  combat  and  peacetime  usage  are  given  on  Tables  XVIII  and 
XIX. 

d.  F-100  Bending  Moment  Spectra 

Bending  moment  spectra  for  two  wing  stations,  two  fuselage  stations,  and 
the  vertical  tail  root  are  shown  in  Figures  70  through  74*  These  are  taken  from 
the  flight  measured  loads  on  lifting  surfaces  from  normal  service  operations. 

The  Phase  III  laboratory  fatigue  tests  were  conducted  to  the  loading  spectra 
defined  by  Figure  70  for  the  wing  root.  A  failure  was  experienced  during  the 
tests  to  the  "fitted"  correlation  which  was  conservative.  The  tests  have  been 
resumed  but  a  revised  correlation  is  used.  Figure  75,  which  is  a  more  realistic 
representation  of  the  latest  ASIP  loads  data. 

A  histogram  representing  the  frequency  of  occurrence  of  wing  root  bending 
moments  is  presented  on  Figure  76.  These  data  are  for  the  3308  flight  hours 
recorded  in  the  Phase  I  program,  correlated  from  113.4  hours  of  good  strain 
gage  readings  taken  from  Yankee  #2,  Figure  69.  The  data  are  converted  to  a 
spectrum  and  probability  curve  on  Figure  70.  The  data  are  further  converted 
into  spectra  defined  in  terms  of  percent  of  limit  load  on  Figure  77.  Correspond¬ 
ing  histograms  and  spectra  for  the  wing  midspan  banding  moment s  are  shown  on 
Figures  78  and  71. 

Fuselage  bending  moment  data  at  Stations  310  and  369  are  shown  on  Figures 
79,  72,  80,  and  73,  respectively.  A  histogram  for  vertical  tail  root  bending 
moment  is  given  on  Figure  81.  The  corresponding  spectrum  and  probability  curves 
are  presented  in  Figure  74. 

e.  Comparison  of  Spectra  for  Loads  and  Load  Factors 

The  plot  of  normal  load  factor  and  loads  at  four  stations  on  the  airplane 
versus  percent  of  design  limit  load.  Figure  6?,  is  a  significant  comparison. 

This  puts  the  usage  loads  in  perspective  with  the  normal  load  factor.  While  it 
is  true  that  the  normal  load  factor  spectrum  is  severe,  the  accompanying 
loads  are  relatively  low  in  comparison  to  design  limit  strength  values.  There 
are  two  reasons  for  this.  First  the  usage  spectra  is  primarily  at  subsonic 
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TABLE  XVII 

WING  ROOT  BENDING  CORRELATION  WITH  LOAD  FACTOR  (PHASE  I) 
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TABLE  XVIII 

WING  ROOT  BENDING  CORRELATION  WITH  LOAD  FACTOR  (CCKBAT  USAGE) 


s' 

o 

CO 

CO 

£^- 

CO 

4 

NO 

s 

NO 

5 

00 

s 

T 

T 

o- 

~ V” 

04 

£ 

T 

CA 

«? 

A 

LA 

nO 

O- 

A 

CD 

A 

T 

-4 

p 

O- 

A 

" 

o 

cu 

LA 

(A 

r- 

PA 

On 

P 

A 

O 

c- 

C 

✓1 

P 

cm 

c°, 

~4 

NO 

o- 

On 

O 

ON 

ON 

7 

i  s- 

c 

CO 

o 

o 

CO 

o 

CM 

A 

A 

A 

co 

A 

r- 

o 

A 

1  o 

o  • 

LA 

-4 

*A 

-4 

-4 

A 

A 

O 

IN 

00 

cv 

o 

co 

O 

<0  P 

PA 

* — I 

A 

4 

A 

A 

NO 

-t 

-4 

CM 

co 

On 

<D  c 

rH 

CM 

vO 

co 

o 

CA 

A 

NO 

04 

-4 

« 

M 

1 — < 

P 

p 

P 

■P 

H 

o 

3  X 

6- 

M  0Q 

1  o 

o  • 

rH 

o 

cm 

C- 

(V 

•  o 

O'  rH 

rH 

rH 

d  o 

04 

-4 

P 

CA 

H 

CO 

P 

•  • 

-4 

LA 

CA 

00  O 

1 

o  o 

-4 

o 

O 

O 

LA 

p 

NO 

p 

CA 

i\ 

CA 

o 

o 

p 

0-  CO 

rH 

CM 

cm 

1 

rH 

CA 

PA 

CO 

NO 

o 

PA 

3 

CA 

P 

o  o 

rH 

LA 

CM 

& 

ON 

A 

c 

•  • 

rH 

A 

NO 

CM 

p 

NO  O- 

o 

p 

1 

CM 

C-- 

VO 

o 

p 

A 

o 

CA 

NO 

o 

o  o 

CA 

cm 

PA 

O 

On 

cm 

•o 

IP 

•  • 

A  nO 

PA 

PA 

rH 

c? 

On 

P 

a 

U 

""""" 

— 1 - 

3 

o  o 

•  • 

P 

O- 

o 

A 

A 

NO 

CA 

c- 

CA 

S 

22' 

-4  A 

P 

P 

P 

CO 

CA 

On 

A 

3 

4 

1 

o  o 

NO 

rH 

NO 

P 

A 

LA 

04 

$ 

3 

-4 

O 

r> 

CM 

o 

CA 

o 

A 

p 

NO 

o 

GO 

PA 

_ 

P 

1 

o 

P 

t — 1 

04 

A 

CD 

A 

•  • 

o 

rH 

£ 

A 

r- 

£n- 

o 

CD 

04  CA 

CM 

o- 

04 

NO 

t- 

On 

P 

vO 

f) 

p 

*4 

— 

_ 

_ 

_ 

_ 

P 

p 

o 

CM 

LA 

LA 

PA 

'o" 

CO 

c- 

f? 

04 

8 

C0 

nO 

04 

3 

-4 

o- 

cm 

rH 

o 

CO 

P 

§ 

NO 

0 

A 

o 

CA 

On 

CA 

• 

• 

• 

o 

0> 

O'- 

NO 

NO 

A 

-4- 

-J- 

CA 

04 

P 

• 

• 

rH 

• 

• 

* 

• 

• 

• 

• 

• 

o 

x}  XI 
c  C 

O  to 

rH 

4 

rH 

1 

C^- 

rH 

d 

d 

1 

CM 

LA 

1 

LA 

CO 

1 

PA 

P 

d 

A 

ci 

NO 

1 

£ 

1 

1 

04 

A 

& 

1 

CO 

o 

NO 

C**y 

1 

04 

On 

d 

1  wo  => 

ca 

CV 

CM 

O 

On 

On 

NO 

NO 

A 

-* 

CA 

04 

P 

rH 

rH 

P 

rH 

rH 

O' 

vO 

ca 

o 

c- 

P 

00 

A 

OH 

On 

nO 

PA 

o 

C- 

P 

03 

A 

p 

1“  .8 
O  rH 
H  1 

• 

• 

• 

* 

« 

• 

* 

• 

• 

• 

• 

• 

• 

* 

• 

• 

• 

c 

IP 

‘A 

d 

A 

CA 

A 

d 

A 

1 

r- 

f 

-t 

H 

f 

CO 

% 

CA 

CM 

T 

On 

NO 

04 

1 

CA 

7 

c- 

P 

1 

_  ■» 

7 

P 

<A 

1 

A 

• 

04 

• 

C 

• 

* 

* 

• 

• 

• 

• 

• 

• 

• 

• 

« 

• 

• 

• 

• 

« 

« 

K  *rl 

ITS 

A 

A 

-4 

PA 

CA 

CA 

04 

04 

cv 

04 

p 

P 

P 

04 


CA 


£ 


-  159  - 


TABLE  XIX 

WING  ROOT  B0JDING  MOMENT  CORRELATION  WITH  LOAD  FACTOR  (PEACETIME  USAGE/ 
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Cumulative  Frequency  of  Occurrences  in  5500  Hours 
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FIGURE  71.  F-1Q0  ASIP  PHASE  I  WTNG  KIDS  PAN  BENDING  MOMENT  SPECTRUM 
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FIGURE  75. 

F-100  At  IP  PHASE  I  WING  ROOT  BENDING 
MQK0TT  SPECTRUM  (REV.) 
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FIGURE  76.  F-100  ASIP  WING  ROOT  BENDING  MCMOrT  HI5TCDRAX 


FIGURE  77.  WING  LOADING  SPECTRA  SUMMARY 
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FIGURE  79.  F-100  ASIP  FUSELAGE  STATION  310  BENDING  MQKS2JT  HISTGGRAH 
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FIGURE  00.  F-100  ASIP  FUSELAGE  STATION  369  BENDING  MOMENT  HISTXRAM 
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Kach  number ,  whereas  the  critical  wing  and  horizontal  tail  loads  occur  at 
high  transonic  Mach  numbers  at  greater  dynamic  pressure.  The  usage  loade 
therefoia  occur  at  higher  airplane  attack  angles  which  are  associated  with 
inboard  load  centers  of  pressure  and  thus  less  bending  moment  than  those  at 
the  critical  design  conditions.  Limit  values  for  the  loads  and  load  factors 
presented  on  Figure  e>7  are  given  on  Table  XI. 

TABLE  XX 


F-100  ALLOWABLE  LIMIT  VALUES  AT  PERTINENT  STATIONS  -  NORMAL 

(Symaetric) 


Normal  Load  Factor 

n  =  +7.33  and  -3.0  g's 
z 

=  +71.9  and  -29.4  Meters/Sec. ^ 

Wing  Root  B.M.  @  ASIP  Strain 

Mv  -  5.22(1C)6  in. -lbs. 

Gate  Station 

“  60.15(10)^  Meter-Kilograms 

Wing  Midspan  B.M.  @  ASIP  Strain 

M  =  2.73(10)6  In. -lbs. 

Gage  Station 

=  31.43(10)^  Meter-Kilograms 

Aft  Fuselage  Sta.  310  B.M. 

M  -  8.35(10)6  in. -lbs. 

■  102(10)"'  Meter-Kilograms 

Aft  Fuselage  Sta.  369  B.M. 

My  «=  5.48(10)6  in. -lbs. 

*=  61.3(10)^  Meter-Kilograms 

Horizontal  Tail  Root  B.M. 

Mx  -  0.64(10)6  in. -lbs. 

“  7-375(10)^  Meter-Kj logrsms 

The  lateral  load  factor  usage  spectra  and  loads  versus  percent  of 
design  limit  load.  Figure  66,  are  so  small  that  they  are  insignificant. 
However,  theae  spectra  were  applied  in  the  structures  laboratory  where  the 
testa  were  terminated  after  a  scatter  factor  of  four  was  attained.  Limit 
values  for  the  lateral  factors  are  listed  on  Table  XXI. 

6.5  COMPUTER  PROGRAM  APPLICATION'S 

a.  Structural  Reliability  -  Time-Independent  (Static)  Conditions 

(l)  General 

The  structural  reliability  congrater  program,  whose  principles  are 
developed  in  Section  2.3,  has  been  used  to  calculate  a  structural,  reliability 
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for  the  F-100.  The  details  of  the  program,  designated  STRREL,  are  given  in 
volume  III.  The  load  spectra,  presented  in  the  previous  section,  are  used  to 
define  the  parameters  used  in  the  computations.  The  inputs  to  the  computer 
are  described  in  the  next  section  and  the  probability  of  failure  and  structural 
reliability,  as  computed  by  the  STRREL  program^  in  the  section  following. 

TABLE  XII 

F-100  ALLOWABLE  LIMIT  VALUES  AT  PERTINENT  STATIONS  -  LATERAL 

(Asymmetric) 


Lateral  Load  Factor 


Vertical  Tail  Root  B.M. 


Forward  Fuselage  Sta.  180  B.M. 


ny  “  3.0  g'e 

“29.4  Meters/ Sec. 2 
Mx  “  0.68(10)6  in. -lbs. 

“  7.84(10)^  Meter-Kilograms 
\  *  1.25C10)6  in. -lbs. 

“  14.4(10)^  Meter-Kilograms 


(2)  Input  Data 

The  load  input  data  for  the  STRREL  program  are  generated  from  the  spectra 
presented  in  Figures  67  and  68.  Two  points  ars  used  to  defins  each  load  spectrum. 

The  points  are  chosen  to  provide  the  best  poesible  fit  of  the  available 
da  am  the  region  of  most  interest  —  at  and  above  limit.  Since  data  above 

f^ei7.aVfiIa^1S  ln  gr°at  quantit7*  a  point  below  limit  may  be  used, 
for  the  F-100  data  the  two  points  used  were  limit  and  a  point,  on  the  extra¬ 
polated  curve  above  limit.  The  loading  parameters  for  the  resulting  distribu¬ 
tions  were  then  determined  by  procedures  described  in  Volume  III.  Since  the 
computer  program  can  be  controlled  to  assume  that  the  loads  distribution  is 

^-normal  or  Weibull,  each  assumption  was  used.  The  resulting  prob- 
of  "9X‘-«®dir*g  load  for  each  of  the  three  types  is  shown  on  Figure  82. 

This  figure  shows  the  small  differences  between  these  three  assumed  distributions 
when  hey  are  all  defined  by  the  two  points  used  in  the  computer  program  STRREL. 

The  strength  input  data  for  the  F-100  are  not  easily  determined.  The 
structure  is  of  conventional  aluminum  alloy  construction  which  traditionally 

has  small  strength  scatter.  If  the  "A"  and  "B"  allowables  in  MIL-HDBK-518  are 
assumed  to  represent  99?  and  90?  probabilities,  respectively,  a  value  of  Y  “.024 

can  be  calculated  for  7075-T6  aluminum  alloy  sheet.  The  variables  added  in 
manufacturing  will  increase  thio  value  considerably.  No  strength  scatter  data 
for  the  F-100  can  be  obtained  from  the  hundreds  of  tests  conducted  because  of 
the  lack  of  duplication  in  the  test  program.  However,  a  collection  of  test 
results  from  throughout  the  industry  has  shown  that  a  value  of  y  ranging  from 

about  ,02  to  .08  may  be  expects'1  for  conventional  construction.2  *  Although  the 
correct  value  for  each  location  on  the  F-100  is  not  known,  the  reader  may 

,*1“’ y- "  -oe  t0  th’ 
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(3)  Computed  Results 


The  structural  reliabilities  at  the  various  wing  and  fuselage  stations 
were  computed  for  a  range  of  strength  scatter,  y  .  The  results  are  plotted 

on  Figures  83,  84  and  85,  and  summarised  in  Table  XXII .  The  vertical  tail 
loads  were  sc  lew,  as  shown  c-n  Figure  08,  that  th°  numerical  values  were  cut- 
side  the  capability  c-f  the  oThhSL  program.  Accordingly,  vertical  tail  or 
fuselage  side  banding  probabilities  of  failure  are  negligibly  low  and  are  net 
available . 


TABLE  XXII 

F-100  COMPUTED  STATIC  STRUCTURAL  RELIABILITIES 


Assumed 

Distribution 

>s 

Normal 

(Fig.  83) 

Lognormal 

(Fig.  84) 

Weibull 

(Fig.  85) 

.05 

.99993 

.99993 

.99987 

.10 

.9977 

.9977 

.996 

.14 

.991 

.9912 

.989 

The  miner  difference  between  the  results  obtained  using  the  three1  distr  - 
butiens  illustrates  the  fact  that  the  computed  reliability  c-f  the  structure 
is  not  sensitive  to  assumptions  regarding  the  shape  of  the  distribution 
functions.  The  reliability  is  much  more  sensitive  to  strength  scatter  than 
to  variations  in  the  loading  and  strength  distributions,  as  shown  by  Figures 
83,  84  and  85. 

b.  Structural  Reliability  -  Time-Dependent  (Fatigue)  Conditions 
tl)  General 

The  fatigue  reliability  computer  program,  whose  principles  ar«  developed 
in  Section  2.4  and  in  \ ultimo  HI,  has  been  used  t.c  calculate  a  fat Igue 
reliability  for  the  F-1O0.  The  program  is  described  in  detail  in  Volume  HI. 

The  load  spectra  presented  in  Lection  6.4  are  used  to  define  parameters  for 
computation.  The  formulation  of  the  problem  and  the  computer  inputs  are 
described  in  the  next  section  and  the  results  of  the  fatigue  reliability 
calculations,  as  performed  by  the  FATKEL  pregram,  in  the  section  following. 

(2)  Input  Data 

The  load  spectra  used  for  the  fatigue  reliab.lity  calculations  are  based 
on  the  data  given  in  Figure  82.  These  data  were  also  used  in  setting  up  the 
fatigue  test  conditions  in  the  f-IGO  ASIP  program.  This  test  program  provided 
accurate  stress  data  i'o.r  the  calculations .  Figure  86  shows  some  typical  stress 
versus  load  data  fr--m  the  wing  root  fillet  area.  The  nonlinearity  at  high  loads 
is  due  to  plastic  yielding  of  the  wing  plate  material  in  the  fillet  area,  which 
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FIGURE  8 t  F-100  ASIP  WING  ROOT  FILLET  AREA  STRESSES 

MEASURED  IN  LABORATORY  TESTS 


limits  the  maximum  stresses  at  high  loade.  Although  the  stresses  in  Figure  86 
are  the  highest  recorded  in  the  ASIP  testa,  failure  occurred  outboard  of  the 
root  at  a  Joint  inboard  of  the  main  landing  gear  trunnion  where  strain  gages 
were  not  applied.  The  loads  applied  to  the  wing  during  these  fatigue  tests 
are  described  by  the  bending  moment  spectra  in  Figure  70.  Subsequent  fatigue 
testing  utilizes  a  revised  bending  moment  spectrum  delineated  in  Figure  75. 

The  stress-bending  moment  curves  for  the  wing  root  are  given  in  Figures  87 
and  68.  Corresponding  curves  for  other  stations  are  given  in  Figures  89  to 
92. 

The  differences  in  stress  magnitudes  shown  on  Figures  86  and  87,  together 
with  the  fact  of  a  test  failure,  indicates  that  a  significant  stress  concen¬ 
tration  existed  at  the  point  of  fracture.  In  order  to  bracket  the  range  of 
failure  probabilities  to  be  expected  from  the  F-100,  a  distribution  of  stress 
concentration  conditions  was  assumsd  for  the  computer  program.  The  results 
from  the  various  assumed  values  are  shown  in  the  next  section. 

Solution  of  the  fatigue  problem  requires.  In  addition  to  the  initial 
static  strength  data  used  in  the  static  structural  reliability  calculations, 
an  S-fJ  curve  describing  the  fatigue  life  characteristics  of  the  basic 
material.  The  data  used  is  shewn  in  Figure  93*  A  folded  scale  is  used  to 

12 

extrapolate  the  curve  to  10  cycles. 

(3)  Computed  Results 

The  F-100  results  from  the  fatigue  computer  program  of  Volume  III  of 
this  report  are  shown  for  four  airframe  situations  measured  in  the  ASIP.  The 
computed  results  are  presented  graphically  as:  (1)  the  cumulative  probability 
of  failure  during  fleet  operation.  Figures  94-,  98,  102,  106,  and  110;  (2)  the 
probability  of  passing  laboratory  tests.  Figures  95,  99,  .'.03,  107,  and  111; 

(3)  the  probability  of  failing  laboratory  tests.  Figures  96,  100,  104,  108,  and 
112;  and  (4)  the  probability  of  failure  after  tests  -  fleet  operation. 

Figures  97,  101,  105,  109,  and  113.  These  figures  are  grouped  to  show  the 
results  for  the  original  wing  root  load  spectrum  (Figures  94-97),  the  wing 
root  revised  spectrum  (Figures  98-101),  the  wing  midepan  (Figures  102-105), 
fuselage  station  310  (Figures  106-109),  and  fuselage  station  369  (Figures  110- 
113). 

The  computer  program  tabulations  are  not  shewn  here  since  they  sre  very- 
similar  to  the  second  sample  problem,  the  F-100  wing  root,  shown  on  pages  134 
through  139  of  Volur-j  111.  This  wing  root  station  load  spectrum  was  revised 
midway  in  the  ASIP  program.  Section  6.4d  (bending  moment  spectra  -  correlation 
with  Joad  factors),  to  reflect  the  nonlinear  trends  with  high  angle  of  attack 
and/or  normal  load  factor.  The  revised  wing  root  has  a  somewhat  higher  S.R. 
as  a  result. 


Percent 


FIGURE  87.  F-100  A5IP  WING  ROOT  WORKING  STRESSES  FROM  BENDING 
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FIGURE  90.  F-100  A3IP  FUSELAGE  STATION  310  WORKING  STRESSES 

FROM  BFNDING  MOMENT  SPECTRUM 
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FIGURE  91.  F-100  ASIP  FtT"LAGE  STATION  369  WORKING  STRESSES 

FROM  BfNDIN':  MOMENT  SPECTRUM 
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FIGURE  92.  F-100  ASIP  VERTICAL  TAIL  ROOT  WORKING  STRESSES  FROM 

BENDING  MOMENT  SPECTRUM 
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FIGURE  94.  F-100  WING  ROOT  COMPUTED  FATIGUE  STRUCTURAL  RELIABILITY  - 

FLEET  OPERATION  S-N  SCATTER  -  4 
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FIGURE  95.  F-100  WING  ROOT  CCM°UTED  FATIGUE  STRUCTURAL  RELIABILITY  - 
PASSING  PROBABILITY,  TEST  OPERATION  S-N  SCATTER  -  4 
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FIGURE  97.  F-100  WING  ROOT  COMPUTED  FATIGUE  STRUCTURAL  RELIABILITY- 

FAILURE  PROBABILITY  AT  A  NOMINAL  LIFE  OF  5500  HOURS  AFTER 
TESTS  -  FLEET  OPERATION 
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FIGURE  100.  ™  ROOT  (RSV-)  COMPUTED  FATIGUE  STRUCTURAL  RELIABILITY  - 
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FIGURE  101. 


F-100  WlfC  R07T  (REV.)  COMPUTED  FATIGUE  STRUCTURAL 
RELIABILITY  -  FAILURE  PROBABILITY  AT  A  NOMINAL  LIFE 
OF  5500  HOURS  AFTER  TESTS  —  FLEET  OPERATICN 
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FIGURE  103.  F-100  WING  MIDSPAN  COMPUTED  FATIGUE  STRUCTURAL  RELIABILITY 

PASSING  PROBABILITY,  TEST  OPERATION  S-N  SCATTER  * 
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FIGURE  104.  F-100  WING  MIDSPAN  COMPUTED  FATIGUE  STRUCTURAL  RELIABILITY  - 

FAILING  PROBABILITY,  TEST  OPERATION  S-N  SCATTER  *  4 
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FIGURE  109.  F-100  FUSELAGE  STATION  310  CCHPUTED  FATIGUE  STRUCTURAL 

RELIABILITY  -  FAILURE  PROBABILITY  AT  A  NCtttflAL  LIFE  OF 
-1,0.'  HOURS  AFTER  TESTS  -  FLEET  OPERATION 
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FIGURE  HO.  F-100  FUSELAGE  STATION  369  COMPUTED  STRUCTURAL  RELIaBILLi 

FLEET  OPERATION  S-N  SCATTER  *  4 
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FIGURE  111.  F-100  FUSELAGE  STATICS  369  COMPUTED  FATIGUE  STRUCTURAL  REUABILITT  - 
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6.6  CORRELATION  BETWEEN  COMPUTER  PREDICTION  AND  OPERATIONAL  EXPERIENCE 


A  new  method  for  computing  reliability  of  structures  can  be  properly 
evaluated  only  if  the  results  of  the  new  method  can  be  compared  with  known 
facts.  One  reason  for  including  the  F-100  data  in  the  present  study  war.  to 
allow  a  comparison  with  data  from  a  well-established  successful  operational 
airplane.  In  actuality,  however,  a  satisfactory  comparison  becomes  quite 
difficult.  There  are  several  reasons  for  this.  First,  as  discussed  in 
Section  6.3b,  the  exact  number  of  "structural  failures"  cannot  be  determined 
from  the  records  available.  Second,  operations  with  the  F-100  are  continuing 
so  the  failure  rate  to  the  end  of  the  F-100  service  life  is  not  known  at 
present.  As  was  pointed  out  in  Volume  I,  the  actual  reliability  of  a  structure 
cannot  be  determined  from  the  failure  rate,  even  after  the  last  flight  of  the 
last  aircraft  in  the  fleet.  Third,  the  computed  structural  reliability  figures 
are  subject  to  all  of  the  difficulties  discussed  in  the  previous  sections  of 
this  report.  However,  a  comparison  of  the  best  figures  available  to  represent 
the  operational  experience  with  those  predicted  by  the  computer  program  as 
described  in  Section  6.5  will  be  most  useful. 


It  was  noted  in  Section  6.3b  that  the  exact  number  of  F-1CO  structural 
failures  could  not  be  determined,  but  it  was  decided  there  that  20  was  an 
appropriate  number  to  use.  These  failures  have  occurred  during  the  3 , 786, 210 
hours  of  F-100  operation  as  established  in  Section  6.3b.  From  these  figures 
the  failure  rate  (i.e.,  failures  per  hour)  can  be  determined  to  be 

20/3.7862(10) 6  =  5.282  x  10-6.  If  it  is  assumed  that  the  failure  rate  is  a 
constant,  the  structural  reliability  for  a  stated  service  life  can  be  approxi¬ 
mated  by  using  the  Poisson  law.'*0’  ^ 

S.R.  =  e  4 


where 


S.R.  =  Structural  Reliability 

e  =  2.7182 

A  =  Failure  Rate 


Number  of  Failures 
Total  Fleet  Hours 


Stated  service  life 


If.  S.R.  is  large  (greater  than  0.9),  the  formulation  can  be  simplified  to 
S.R.  *  1.0  -  A  T 


From  this  and  the  failure  rate  determined  above,  it  can  be  calculated  that 
the  structural  reliability  for  F-100' s  whose  service  life  is  2000  hours  is 
0.99.  If  the  service  life  is  extended  to  5500  hours,  the  structural 
reliability  would  drop  to  0.97.  However,  the  ASIP  program,  described  in 
Section  6. La,  is  intended  to  increase  the  service  life  of  the  F-100's  to 
5 *>00  hours.  Additional  fatigue  testing  and  the  ensuing  modifications  under 
.ie  ASIP  program  should  decrease  the  F-100  failure  rat*  Because  of  this  the 
modified  F-100' •  could  be  expected  to  havo  a  higher  structural  reliability 
than  the  0.97  value  for  5500  hours. 
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As  has  been  noted,  the  value  of  20  for  the  number  of  failures  to  date 
in  the  F-100  fleet  is  eomevhat  arbitrary.  If  the  true  value  is  something 
other  th&n  20,  the  structural  reliability  number  would  be  changed.  Figures 
114  and  115  show  how  the  S.R.  would  vary.  It  should  be  noted  on  Figure  115 
that,  if  a  0.99  S.R.  is  to  be  attained  at  a  service  life  of  5500  hours,  no 
more  than  seven  failures  should  have  occurred  at  the  present  time. 

TABLE  mil 


F-100  COMPUTED  F ATI ODE  RELIABILITIES 


Fatigue 

Teat  Tima 

5500  Hours 

11,000  Hours 

22,000  Hours 

Item  4 

Ref. 

Fatigue 

Fatigue 

and 

Static 

Fatigue 

■ 

Fatigue 

Fatigue 

and 

Wing  Root 
(Fig.  97) 

.85 

.908 

.935 

.991 

.99993 

?  ,910 

Wing  Root 
(Rev.) 

(Fig.  101) 

.922 

.955 

.963 

.9993 

*95 

>,98 
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Results  of  the  fatigue  reliability  analysis  are  given  in  Table  XXIII.  The 
reliabilities  in  this  table  are  the  reliabilities  to  be  expected  in  service  in 
a  nominal  5500  hour  lifetime  following  a  fatigue  test  to  one  of  the  three 
test  lengths  indicated,  also  followed  by  a  static  test  where  indicated.  Values 
are  given  for  all  five  airplane  locations  included  in  the  study.  The  most 
fatigue-sensitive  location,  the  wing  root,  has  a  computed  fatigue  reliability 
of  0.85  after  passing  a  fatigue  test  to  5500  hours.  The  figures  on  Table  XXIII 
illustrate  the  benefits  to  be  gained  by  extending  the  test  time  or  by  running 
a  static  test  at  the  end  of  the  specified  fatigue  test.  Either  method  will 
assure  a  significantly  improved  fatigue  reliability  level  of  a  structure  that 
passes  the  prescribed  tests. 

The  F-100  structural  reliability  as  computed  by  the  methods  developed 
herein,  static  and  fatigue,  was  based  primarily  on  the  measurements  made  in 
the  Aircraft  Structural  Integrity  Program.  That  ie,  the  load  and  strength 
spectra  at  five  locations  on  the  airframes  (tws  wing  stations,  two  fusslsge 
stations  -  one  of  which  includes  the  horlsontal  tail  -  and  the  vertical  tail 
root)  were  taken  frcm  the  Air  Force  operational  data.  The  static  reliability 
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FIGURE  114.  F-10G  FLEET  STRUCTURAL  RELIABILITY  -  2000  HOURS 


Reliability 


of  the  operational  fleet,  which  was  estimated  on  page  209  to  be  0.99  at.  2000 
hours,  ia  not  inconsistent  with  the  predicted  results  as  summarized  on 
Table  XXII.  Of  those  stations  included  in  this  analysis,  the  fatigue  structural 
reliability  as  calculated  with  the  computer  program  shows  the  wing  root  zone  to 
be  the  most  critical  area  on  the  airplane.  This  has  been  verified  during  the 
AS1P  program.  In  Section  6.2c  it  is  noted  that  a  wing  root  failure  occurred 
at  4674  hour*.  Thie  test  and  failure  together  with  the  operational  results 
show  a  most  gratifying  correlation  with  the  structural  reliabilities  predicted 
by  the  FATREI,  computer  program  as  summarized  on  Table  XXIII. 
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SECTION  VII 


ADVANTAGES  AND  DISADVANTAGES  OF  THE  NEW  PROCEDURE 


7.1  GENERAL 

The  new  procedure,  described  in  the  previous  sections  of  this  volume, 
has  many  advantages  ovjr  the  Present  System  and  over  a  Purely  Statistical 
Structural  Reliability  System.  Inevitably,  there  must  be  some  problem  areas 
in  any  new  procedure.  These  advantages  and  disadvantages  must  be  judged 
dispassionately  to  determine  the  true  value  of  the  new  procedure.  If  the 
advantages  do  not  outweigh  the  disadvantages,  it  would  be  illogical  to 
implement  the  new  procedure. 

It  appears  that  the  new  procedure  retains  the  desirable  features  of  the 
Present  System  while  modifying  the  system  to  incorporate  all  of  the  character¬ 
istics  recommended  in  Section  3.6  of  Volume  I.  Host  of  the  problem  areas 
associated  with  the  new  procedure  have  always  been  problem  areas.  The  new 
procedure  does  not  create  new  problems,  although  it  may  recognize  more  clearly 
those  that  already  exist. 

7.2  ADVANTAGES 

The  basic  advantage  of  the  new  procedure  is  its  ability  to  logically 
jotablish  the  structural  performance  necessary  to  achieve  a  quantitatively 
definable  goal.  This  permits  a  realistic  definition  of  the  minimum  structure 
required  to  meet  this  goal.  It  also  clearly  indicates  those  structural  and 
operational  characteristics  that  will  Justify  the  uee  of  less  severe 
structural  design  criteria.  Because  each  of  these  requirements  is  quantitized, 
trade-offs  can  be  made  evaluating  the  benefits  of  criteria  reduction  against 
the  difficulties  of  providing  the  characteristics  that  will  validate  the 
criteria  reduction.  Other  advantages  are  listed  below: 

a.  The  new  procedure  represents  a  modification  at  the  Present  System,  not  a 
radical  upheaval. 

Since  the  procedure  represents  a  modification  of  the  Present 
System,  rot  a  completely  different  approach,  structural 
designers  and  analysts  dc  not  need  to  unlearn  their  prseant 
methods.  The  form  of  the  structural  design  procedure  is 
unchanged  although  the  numbers  and  the  meaning  of  the  numbers 
may  change.  Baring  the  initial  phases  of  Implementing  the  use 
of  the  new  procedure,  numbers  from  both  the  old  and  the  new 
procedures  can  be  compared.  This  will  result  in  greater 
confidence  in  ths  validity  of  the  new  procedure.  It.  will 
mean  that  the  changes  from  currant  procedures  will  be 
evolutionary  rather  than  revolutionary. 
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b.  Specific  requirements  in  the  new  procedure  ere  practical  end  easily 
adndnietrable. 

Although  the  new  procedure  recognitee  the  etatiatical 
nature  of  the  function#  involved,  the  requirements  are 
deterministic.  The  choice  of  limit  and  omega  conditions 
is  based  on  the  expected  probability  of  exceeding  the 
condition.  Once  the  decision  is  made,  the  discrete  condition 
becomes  the  requirement.  Because  the  requirements  are 
discrete,  they  can  be  administered  effectively.  Proof  of 
compliance  is  a  go,  no-go  proposition  which  results  in  a 
sharp  line  of  demarcation  between  the  acceptable  and 
unacceptable  structural  system. 

c.  The  structural  and  non- structural  requirements  are  decoupled  but  there 
is  a  well  defined  interface  between  the  two. 

In  a  Purely  Statistical  Structural  Reliability  System,  the 
requirements  and  responsibilities  of  the  structural  and 
non-et ruotural  system  become  so  intertwined  that  it  is 
impossible  to  administer  the  requirements.  With  the 
decoupling  associated  with  definition  of  discrete  limit 
and  omega  conditions,  it  becomes  possible  to  make  decisions. 

Even  though  a  limit  condition  la  intended  to  be  a  condition 
that  is  not  exceeded  very  often,  the  designation  of  the  con¬ 
dition  aa  limit  carries  with  it  the  connotation  that  the 
condition  is  the  upper  bound  of  what  is  expected  and 
permissible.  Therefore,  once  the  limit  condition  is  chosen, 
those  concerned  with  the  operation  of  the  vehicle  and  the 
non-ot ruotural  systems  cannot  be  held  responsible  if  a 
structural  failure  occurs  at  limit  condition  or  less. 

Whether  or  not  the  limit  condition  is  attained  more  frequently 
than  expected  beoomse  immaterial .  The  structural  system  is 
responsible  for  surviving  the  limit  condition  whenever  it 
occurs.  In  the  same  vein,  the  structural  system  is  not 
expected  or  required  to  survive  beyond  the  omega  condition. 

If  a  structural  failure  ever  dose  occur  due  to  exceeding  the 
omega  condition,  the  cause  of  failure  must  be  attributed  to 
an  operation  of  the  vehicle  or  non- structural  system  to  a 
condition  grossly  beyond  the  specified  peraLesible  limit. 

Thue,  the  oause  of  failure  and  the  appropriate  corrective 
aotlon  will  always  be  clear-out.  This  is  a  prerequisite  for 
an  admlnistrabls  system.  In  effect,  a  decision  is  made  in 
advance  in  regard  to  how  the  structural  system  should  perform 
to  avoid  failures  under  expected  conditions  and  how  the  non- 
struotural  systems  should  perform  by  avoiding  conditions 
where  structural  failures  can  be  expected  to  oocur. 
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d.  The  nw  procedure  protects  against  tha  unexpected  degradation  of  structural 
integrity  that  may  result  from  the  use  of  structural  systems  with  large 
scatters  in  strength. 

Current  trends  in  structural  deaign  indicate  a  growing  use 
of  structural  configurations  predisposed  toward?  a  large 
scatter  in  strength.  Structures  operating  near  the  extreme 
of  the  high-tenperature  capability  of  the  material,  large 
shell  structures,  and  the  use  of  brittle  materials  are 
becoming  conmonplace.  These  are  all  conducive  to  larger 
strength  scatter  than  experienced  in.  any  structures  of  the 
past  except  castings.  Since  the  new  procedure  recognizee 
strength  scatter  as  an  important  consideration  in  the 
establishment  of  structural  design  requirements,  it  is 
moet  likely  that  sufficient  provision  will  be  made  to 
accommodate  whatever  degree  of  strength  scatter  occure  in 
future  structures. 

e.  The  new  procedure  encourages  reductions  in  the  severity  of  the  structural 
deaign  criteria  and,  thus,  the  weight,  of  the  structure  by  stipulating 
the  situations  Justifying  such  reductions. 

The  Present  System  has  no  mechanism  to  Justify  a  reduction 
in  requirements.  At  bast,  any  attempt  at  reductions  becomes 
a  subjective  action  based  almost  entirely  on  Judgment.  Tha 
new  procedure  permits  the  reduction  of  design  factors  to  any 
level  doolred  but  sets  the  conditions  necessary  to  Justify 
the  reduction.  This  permits  the  designer  the  option  of  signif¬ 
icant  weight  reductions  provided  the  price  is  paid  in  terms  of 
more  careful  control  of  operations  and  more  stringent  limitations 
on  the  structural  configuration.  Multiple  test  articles  can  bo 
another  Justification  for  reducing  the  structural  criteria  if 
the  cost  and  schedule  problems  involved  can  be  accepted. 

f.  The  new  procedure  provides  for  the  examination  and  poeitive  control  of  the 
environmental  functions  that  significantly  affect  structural  reliability. 

By  providing  a  line  of  demarcation  between  the  regions  where 
the  structural  and  the  non-structural  system*  are  responsible 
for  preventing  failures,  the  way  is  opened  to  controlling 
the  exceedance  of  the  specified  conditions.  The  structural 
criteria  is  transformed  from  a  passive  document  that  assumes 
that  future  ve hides  will  have  the  same  structural  and 
operational  characteristics  as  past  vehicles  to  a  procedure 
that  provides  a  framework  for  specifying  the  aotive  steps  to 
ensure  that  critical  functions  are  controlled  to  provide  the 
desired  results. 
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g.  The  nmr  procedure  identifies  a  quantitative  objective  that  leads  to  a 
oor.sistent  and  logical  relationship  between  all  elements  of  the  structural 
system. 

A  simple  factorial  relationship  between  limit  and  ultimate 
loads,  as  in  the  Present  System,  does  not  neoessarily 
provide  the  capability  in  all  components  of  the  vehicle  to 
survive  the  same  operational  condition.  Therefore,  some 
components  are  overdesigned  relative  to  others.  In  the  new 
procedure,  the  conditions  to  bs  survived  are  chosen  and  each 
component  on  the  vehicle  must  survive  the  loads  at  that 
condition  —  no  more  and  no  lees. 

h.  Fatigue  and  high  temperature  considerations  are  integrated  into  the  new 
procedure  following  the  same  basic  principles  developed  for  the  static 
conditions. 

The  approach  to  fatigue  and  high-temperature  situations  is 
handled  as  a  simple  extension  of  the  philosophy  developed 
for  static  conditions.  There  is  none  of  the  uncertainty 
exhibited  in  other  proposed  criteria  for  hot  structures. 

The  requirement  is  that  most  of  the  structures  must  survive 
the  omega  condition.  This  requires  survival  at  the  local 
temperatures  which  are  determined  for  the  omega  condition. 

There  is  no  factorial  relationship  between  temperatures  at 
limit  and  omega  conditions.  The  temperatures  at  limit  and 
omega  are  simply  those  appropriate  to  the  two  design  condi¬ 
tions.  The  fatigue  situation  is  oomparable  in  that  a  high 
degree  of  reliability  at  the  nominal  or  limit  life  ie 
provided  by  designing  and  tasting  to  multiples  of  the 
nominal  life.  Assurance  that  most  of  the  structures  will 
survive  to  a  life  substantially  beyond  the  nominal  life  ia 
obtained  from  the  same  design  and  test  requirement  that 
satisfies  the  limit  requirement, 

7.3  DISADVANTAQ8S 

Any  proposal  to  change  structural  design  criteria  procedures  inevitably 
will  encounter  some  arguments  against  making  such  a  change.  These  arguments 
must  be  recognised  and  answered  before  there  can  be  general  acceptance  of  the 
new  procedure.  Same  of  the  potential  disadvantages  and  problem  areas  are 
listed  in  this  section.  It  should  be  noted  that  it  is  not  naoassarily  agreed 
that  all  items  listed  represent  disadvantages  or  problem  areas.  However,  the 
list  contains  most  of  the  pertinent  questions  raised  by  those  who  have  been 
exposed  to  the  new  procedure. 

a.  The  proposed  new  procedure  represents  a  ohange  from  the  Present  System. 

It  is  a  simple  fact  that  change  is  always  resisted  — 
sometimes  rationally,  sometimes  arbitrarily.  It  must  be 
recognised  that  there  is  a  built-in  reluctance  among  all 
engineers  to  ohange  any  procedure  that  has  been  successful. 
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Therefor*,  th«  advantages  mist  be  clear-cut  and  th*  problems 
must  ba  resolved  so  that  there  is  no  logical  reason  for 
resisting  the  change  to  the  new  procedure. 

b.  Th*  new  procedure  calls  for  the  definition  of  two  sets  of  design  condi¬ 
tions,  limit  and  omega. 

Traditionally,  aerospace  structural  systems  have  been 
designed  for  a  single  design  condition.  The  limit  loads 
have  beer,  mil  tl plied  by  a  factor  of  safety  to  obtain 
ultimate  leads.  These  ultimate  loads  ars  still  considered 
to  be  associated  with  the  velocity,  load  factor  and  other 
parameters  at  tho  limit  condition.  In  the  new  procedure,  an 
omega  condition  may  specify  different  velocity,  load  factor 
and  other  parameters  from  those  at  the  corresponding  limit 
condition.  It  does  not  appear  that  this  is  a  radical  departure 
from  present  practice.  It  is  not  unusual  to  perform  an 
analysis  at  limit  for  buckling  or  yielding  and  a  separate 
analyaie  at  ultimate  for  total  rupture.  Conceptually, 
separate  limit  and  omega  condition  analyses  are  no  different 
than  the  analyses  performed  for  any  two  conditions  at  present, 
such  as  a  high-speed  and  a  low-speed  flight  condition. 

c.  The  analysis  of  the  extra  conditions  may  cost  more  and  take  longer. 

The  added  requirements  for  two  sets  of  conditions  undoubtedly 
will  require  more  analysis  than  before.  However,  in  moat  cases, 
it  should  be  possible  to  decide  by  inspection  whether  the  limit 
or  the  omega  condition  is  critical.  This  same  procedure  is 
used  now  to  reduce  hundreds  of  potentially  critical  conditions 
to  tan  or  twenty  that  are  analysed  in  dotail.  Whatever  extra 
cost  is  involved  will  have  to  be  recognised  as  the  price  p*id 
to  gain  the  advantages  listed  in  the  previous  section. 

d.  Establishment  of  requirements  for  an  om*ga  condition  beyond  the  limit 
condition  represent*  an  extension  of  structural  responsibility  into 
operational  regions  not  considered  in  pset  practice. 

Actually,  the  omega  condition  requirement  is  not  as  great  a 
break  with  traditional  design  practices  of  the  past  as  it 
may  seem  on  the  surface.  For  those  design  conditions 
governed  by  suit 1 plying  limit  loads  by  the  factor  of  safety, 
some  overload  capability  has  always  been  available. 

Although  the  amount  of  structural  capability  was  fixed,  the 
amount  of  operational  capability  was  not.  In  special  situa¬ 
tions,  where  the  increment  in  operational  capability  was 
obviously  small,  ultimate  conditions  have  been  specified  in 
the  past.  The  landing  gear  situation  represents  a  well-known 
example  of  thie.  Even  if  the  landing  gear  has  the  strength 
capability  to  withstand  150  percent  of  the  limit  loads,  it 
may  fail  at  an  Jjg>aot  velocity  very  slightly  higher  than  the 
limit  velocity.  For  one  thing  the  energy  involved  increases 
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at  tha  square  of  tho  Impact  velocity.  Possibly  more 
important  is  the  fact  that  ths  energy  absorption  character¬ 
istics  of  the  landing-gear  system  are  critically  dependent 
on  euch  things  as  the  geometry  of  the  gear  linkage,  bottoming 
characteristics  beyond  ths  normal  stroke,  and  the  design  of 
metering  pins. 

The  need  for  an  omega  condition  in  a  statistically  based 
procedure  stems  from  ths  fact  that  most  failures  in  mature 
structural  systems  (after  any  initial,  defects  have  been 
uncovered  and  corrected)  are  caused  by  conditions  sub¬ 
stantially  beyond  the  limit  conditions.  Figure  26  and  the 
diaoussion  in  Section  2.3a(l)  and  2.3f  show  that  moot  failures 
will  occur  dose  to  the  omega  condition  and  that  the 
probability  of  failure  approximates  the  probability  of  exceeding 
the  omega  condition.  If  conditions  beyond  limit  were  ignored, 
any  probability  of  failure  or  structural  reliability  so 
determined  would  be  meaningless.  Thus,  if  quantitative 
structural  design  criteria  by  statistical  methods  is  a  valid 
objective  for  the  new  procedure,  omega  conditions  or  their 
equivalent  oust  be  considered.  Tha  only  question  is  what 
form  this  consideration  should  take. 

e.  A  requirement  for  structural  capability  at  omega  conditions  might  lead  to 
a  requirement  for  operational  capability  at  these  conditions. 

Concern  has  been  expressed  by  responsible  industry  personnel 
that  definition  of  an  omega  condition  for  structural  design 
might  lead  to  operational  requirements  for  the  same  condition. 

It  is  ing>o*aible  to  control  what  future  responsible 
authorities  will  do.  However,  the  logic  of  the  situation 
should  discourage  any  such  action.  Ths  omega  condition,  by 
definition,  represents  an  abnormal  operational  condition, 
whereas  the  limit  condition  represents  the  upper  bound  of 
normal  or  expected  operational  conditions  required  to 
satisfactorily  perform  the  vehicle's  mission.  It  doss  not 
sssm  reasonable  to  establish  any  opsrational  performance 
requirements  for  an  abnormal  condition,  attained  only  as 
a  result  of  an  operational  error.  All  efforts  should  bs 
directed  toward  avoiding  the  omega  condition  in  order  to 
avoid  the  failure  to  bs  expected  at  the  omega  condition. 

f.  Calculation  of  loads  at  the  omega  conditions  will  introduce  many  new 
problems  into  the  design  process. 

It  is  undoubtedly  true  that  there  will  be  difficulties  in 
calculating  omega  loads.  Deformations  will  be  larger  than 
at  limit  and  in  many  oases  will  bs  in  the  permanent 
deformation  range.  It  is  expected  that  experience  in  such 
analysis  will  relieve  ths  problem  to  soas  extent.  It  seems 
more  rational  to  face  the  problem  squarely  and  make  the  best 
effort  possible.  It  is  inconceivable  that  qualified 
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engineers  could  not  develop  satisfactory  analytical 
techniques  to  solve  this  problem.  The  alternative  of 
accepting  whatever  overload  capability  happens  to  result 
from  indirect  requirements  does  not  seem  to  be  compatible 
with  the  logic  of  a  quantitative  structural  design  criteria. 

The  conventional  factor  of  safety  provides  blanket  coverage  for  situations 

that  might  not  bs  recognized  in  a  more  sophisticated  procedure. 

Pa9t  experience  ha3  shown  that  this  is  a  very  real 
danger.  There  is  such  a  thing  as  being  rational  to  the 
point  of  impracticality.  Concern  over  making  thi3  type  of 
mistake  cannot  be  dismissed  lightly.  Extreme  care  must  be 
taken  during  the  transition  period  between  use  of  the  Present 
System  and  implementation  of  the  new  procedure.  The  problems 
of  implementation  should  be  eased  by  the  similarity  between 
the  two  systems.  The  design  requirements  under  the  new 
procedure  can  be  compared  directly  with  those  for  the  Present 
System.  If  there  is  ever  a  drastic  difference,  this  should 
be  a  signal  for  caution.  The  reasons  for  the  difference 
should  be  determined  and  the  requirements  re-examined. 

Significant  differences  in  the  requirements  of  the  two  systems 
should  not  be  accepted  uncritically.  This  does  not  mean  that 
such  differences,  either  in  the  direction  of  more  critical  or 
lass  critical  requirements,  cannot  be  Justified  under 
appropriate  circumstances. 

The  new  procedure  requires  a  determination  of  the  strength  scatter,  K , 

of  the  structure. 

The  discussion  of  Section  2.3  makes  it  clear  that  the  strength 
scatter,  >a,  is  a  significant  parameter  in  the  development  of 
structural  reliability.  There  has  not  been  much  formal 
documentation  of  the  V3  function  in  the  technical  literature. 
Nevertheless,  there  are  data  available,  usually  as  a  by-product 
of  other  studies,  on  the  strength  distribution  of  various 
materials.  Although  information  on  the  strength  scatter  of 
fabricated  components  is  lees  available.  Borne  does  exist.  A  few 
programs  such  as  those  reported  on  Table  3  of  Reference  29 
furnish  valuable  information  on  the  strength  scatter  of 
conponents.  These  data  can  be  supplemented  by  organizing 
data  where  multiple  tests  have  bran  run  such  as  a  series  of 
box  beams  at  different  temperatures  or  large  shell  structures 
with  various  R/t  ratios.  If  an  envelope  representing  the 
upper  and  lower  range  of  the  test  data  can  be  drawn  using 
engineering  Judgment,  such  data  can  furnish  a  satisfactory 
approximation  of  ths  strength  scatter  coefficient,  Ya.  The 
range  between  the  upper  and  lower  envelopes  of  a  typical 
quantity  of  data  approximates  the  ±2  cr  range.  There¬ 
fore,  the  increment  in  value  from  lower  to  upper  envelope 
can  be  divided  by  4.0  to  obtain  tr  and  then  divided  again 
by  the  midpoint  value  to  obtain  Y  .  Such  a  technique 

is  not  very  elegant  and  might  not  be  rigorous  enough 
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to  satisfy  a  statistician,  but  it  provides  a  reasonable 
engineering  solution.  It  is  bslisvsd  that  enough  data  is 
available  now  to  begin  implementing  the  new  procedure. 

Onoe  the  need  for  data  on  strength  soatter  is  established, 
the  availability  of  such  data  can  be  expected  to  increase 
rapidly. 

i.  The  new  procedure  does  not  solve  the  problem  of  how  to  avoid  the  failures 
that  often  acco^any  the  early  phases  of  the  devalopiaent  of  a  new  vehicle. 

No  procedure  in  the  world  oan  guarantee  that  mistakes  will 
not  be  made.  Structural  design  or it aria  can  and  should  make 
provision  so  the  structure  can  tolerate  a  reasonable  level 
or  error  or  discrepancy  in  the  design,  fabrication,  and 
operation  of  a  vehicle.  This  capability  oust  necessarily 
be  very  limited  or  the  criteria  will  require  an  excessively 
heavy  structure.  In  any  event,  structural  design  criteria 
should  define  requirements  that  the  structure  is  obligated 
to  meet.  Whether  the  design  meets  the  obligation  with  the 
first  structural  configuration  or  whether  the  design  cycle 
mast  be  Iterated  many  tints  is  immaterial  to  the  requirements  • 

The  number  of  iterations  depends  cn  the  technological  skill 
of  the  designer  and  analyst. 


SECT10S'  VIII 


CONCLUSIONS  AND  HECOHMENDATI CNS 


8.1  CONC  .SIGNS 

A  now  procedure  for  defining  statistically-based,  deterministic 
structural  design  criteria  has  been  developed  and  is  presented  in  this  volume. 
This  new  procedure  incorporates  all  oi  the  characteristics  raconmended  in 
Section  3.6  of  Volume  I  as  desirable  for  a  structural  design  system.  The 
procedure  represente  a  modification  of  the  Present  System,  not  a  radical 
upheaval.  Ae  a  result,  the  proposed  structural  design  criteria  are  practical 
and  easily  administr&ble. 

A  new  philosophy  has  bean  formulated  to  describe  the  function  of 
etruotural  design  criteria.  This  new  philosophy  leads  to  a  clearer  under¬ 
standing  of  the  objectives  of  structural  design  as  implemented  in  structural 
design  criteria.  The  essence  of  this  new  philosophy  is  that  a  designated 
level  of  structural  reliability  can  be  attained  by  providing  for  structural 
survival  in  two  specified  situations.  The  first  is  that  Mno"  failure  should 
occur  at  a  condition  defined  as  a  limit  condition.  Since  limit  conditions 
are  designated  ae  permissible  and  expected  to  occur  relatively  frequently, 
the  structural  system  must  have  the  capability  to  survive  these  expected 
conditions  with  near  certainty  if  a  high  degree  of  structural  reliability  is 
to  be  attained.  To  provide  against  the  possibility  of  an  under- strength 
structure,  the  structural  system  should  be  designed  to  withstand  design  loads 
significantly  higher  than  those  at  the  limit  condition.  The  magnitude  of  the 
increment  or  factor  over  limit  le  chosen  so  that  an  understrength  of  that 
amount  will  be  rare  relative  to  the  desired  level  of  structural  reliability. 
Ths  factor  ie  a  discrete  number  defined  by  the  strength  scatter  of  the 
structure  and  by  the  structural  reliability  desired. 

Even  perfeot  reliability  for  the  limit  conditions  would  not  necessarily 
result  in  an  overall  low  failure  rate  that  would  be  acceptable.  Host  of  th6 
designated  limit  conditions  will  be  exceeded  on  occasion,  dus  either  to 
vehicle  operation  beyond  the  prescribed  operational  limitations  or  to  mal¬ 
functions  and  out  of  tolerance  situations  on  subsystems  that  affect  the 
structursl  environment.  Accordingly,  the  second  major  structural  provision 
as  established  by  the  new  philosophy  is  for  "most"  of  the  structural  systems 
to  survive  conditions  that  are  a  specified  increment  beyond  ths  limit 
condition.  The  conditions  associated  with  these  overload  eltuations  are 
designated  omega  conditions  in  this  report.  The  omega  condition  should 
represent  a  groee  exceedance  of  the  limit  condition  and  should  occur  very 
rarely.  If  the  frequency  of  exceeding  the  omega  condition  in  actual 
operations  is  rare,  then  etruotural  failure  will  be  rare  and  the  desired  level 
of  structural  reliability  will  be  attained. 

The  requirements  for  the  new  procedure  are  in  ths  same  format  as  those 
In  the  Present  System  so  that  designers  and  analysts  do  not  need  to  unlearn 
their  present  methods.  Where  ths  structural  and  operational  situations  are 
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co^sarable  to  tboss  of  the  pant.,  v.hs  n«v  requi.rw.vRr.tw  will  bo  essentially 
uncharged.  Where  the  strength  scatter  is  unusually  1  ow ,  where  more  than  one 
teat  a  'tide  can  bo  tssted,  whore  the  overloads  can  be  controlled,  or  where  a 
lover  ntruotural  roll  ability  can  bo  ac  copied,  the  new  procedure  will  Justify 
uaa  of  loss  severe  structural  design  requirements-  If  tho  strength  ecattor 
is  unusually  large  at  in  the  case  of  hot  structure  operating  noar  tho  uppor 
lindt  of  tho  tesaporatura  capability  oi  the  material,  or  with  brittle  structures, 
or  with  systems  which  are  very  sensitive  to  minor  geometrical  variations  as 
in  buckling  of  large  shell  structures,  tho  additional  design  requirements 
naeded  to  maintain  a  oonstant  level  of  structural  reliability  are  defined  by 
tho  r.aw  procedure. 

If  it  ia  desired  to  provide  tho  Present  System  with  a  quantitative 
objective  and  with  tho  capability  to  systematically  resolve  tho  problems 
associated  with  structures  for  advanced  vehicles,  the  structural  design 
system  described  in  this  report  is  needed.  The  new  procedure  retaina  the 
deterministic  type  of  requirements  that  give  the  Present  System  its  practi¬ 
cality  and  adadnistrability.  The  deterministic  requirements  are  established 
in  such  a  way  that  they  correnpord  to  a  etructural  reliability  goal  without 
having  to  prove  directly  that  the  goal  hae  been  achieved.  Ir.  such  an  approach, 
all  of  the  elements  affecting  structural  reliability  are  consistently 
directed  towards  achieving  the  quantitatively  defined  structural  reliability 
goal  without  introducing  the  impossible  problem  of  proving  compliance  with  a 
etructural  reliability  requirement.  Tho  procedure  described  n  this  report  is 
expected  to  accomplish  this  result. 

6.2  RECOMMENDATIONS 

It  is  reoonaended  that  a  carefully  planned  program  be  instituted  to 
gradually  implement  the  new  procedure  described  in  this  report.  It  would  be 
unrealistic  to  expect  that  a  new  procedure  with  many  unexplored  ramifications 
could  be  substituted  abruptly  for  tho  time-tested  approach  incorporated  in 
present  structural  design  criteria,  Sigineers  are  traditionally  suspicious 
(and  Justly  so)  of  new,  "cupe-all"  procedures  that  ostensibly  are  more 
rational  than  the  old  procedure.  Bitter  experience  has  indicated  that  a 
"rational"  procedure  may  be  rational  only  in  a  limited  area.  Frequently, 
there  are  considerations  that  are  covered  by  e^>irioal  requirements  without 
an  explicit  definition  of  such  coverage.  A  new  procedure  may  not  recognise 
tne  need  and  inadvertently  eliminate  the  necessary  ooverage.  There  is  no 
reason  to  boilers  that  such  a  situation  cxlats  in  the  procedure  reocasended 
in  this  report  but  the  possibility  suggests  the  need  to  proceed  cautiously* 

It  appears  that  the  most  advantageous  scheme  for  implementing  the  general 
acceptance  of  this  new  philosophy  and  procedure  would  be  to  apply  it  on  a 
limited  scale  initially,  After  soma  experience  has  been  gained  in  using  the 
procedure,  consideration  could  be  giv«n  to  expanding  its  usage.  This  would 
permit  all  concerned  to  gain  confidence  in  the  proposed  procedure  as  a  useful 
approach  to  the  structural  design  problem.  The  impact  that  the  new  procedure 
might  have  on  cost  and  schedule  oould  be  assessed  from  the  experience  gained 
during  this  suggested  small-seals  tipLeasntaticn  effort. 
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A  limited  effort  to  apply  the  procedure  to  actual  designs  might  be 
obtained  in  one  of  two  ways.  The  new  procedure  could  be  specified  as  a 
permissible  alternate  to  the  present  procedure.  Specific  concurrence  by  the 
Procuring  Agency  could  be  required  fcr  each  use  of  the  new  procedure.  This 
implementation  approach  would  almost  certainly  result  in  the  new  procedure 
being  used  only  when  it  was  less  critical  than  the  present  procedure.  However, 
the  requirement  for  Procuring  Agency  concurrence  would  ensure  that  any  such 
reduction  would  be  subject  to  close  scrutiny  before  acceptance. 

A  second  plan  for  Implement a tion  would  be  to  choose  a  SDecific  vehicle 
and  establish  a  requirement  to  perform  a  parallel  but  separate  study  of  the 
design  rsquirements  using  the  new  procedure.  These  requirements  could  be 
compared  with  those  generated  under  the  present  system  to  determine  whether 
the  new  procedure  would  result  in  adding  or  subtracting  structure  from  a 
structural  system  already  satisfying  the  present  criteria. 

If  the  proposed  new  procedure  ie  deemed  worthy  of  continued  development, 
there  are  a  number  of  steps  that  are  recommended  to  aid  in  the  process  of 
implementation.  Seme  of  these  are  listed  below. 

a.  The  new  procedure  should  be  reduced  to  thertrecise  language  of 
a  specification  comparable  to  MH^A-8860rt'T  In  this  form,  all 
concerned  can  make  a  better  assessment  of  the  inpact  of  the 
new  procedure. 

b.  A  concerted  effort  should  be  started  to  assenfcle  the  data 
presently  available  on  the  strength  scatter  of  materials  and 
fabricated  components.  Steps  should  be  taken  to  obtain  new 
data  as  necessary  to  fill  the  gaps  in  the  available  data.  In 
particular,  more  data  are  needed  on  the  scatter  in  residual 
strength  in  fatigue  situations. 

c.  Develop  better  analytical  capability  to  predict  the  residual 
strength  In  fatigue  situations.  The  residual  strength  method 
adapted  from  Reference  12  as  described  in  Soction  3.2  of 
Volume  III  must  be  considered  to  be  a  first-generation 
solution  to  the  problem.  Improvements  can  be  expected  to 
follow  any  serious  attempt  to  use  the  residual  strength 
concept  in  actual  design, 

d.  Mora  study  is  needed  to  develop  precise  rules  governing  the 
choice  of  limit-  and  omega  design  conditions  in  a  multiple 
parameter  environment.  Such  cases  have  not  been  considered 
explicitly  in  the  examples  presented  in  this  report. 

Validation  of  the  limit  and  omega  design  conditions,  as 
shown  on  Figure  46,  comes  as  a  result  of  a  decision  that 
the  actual  operations  are  consistent  with  the  initial  pre¬ 
dictions  used  in  choosing  the  design  conditions.  The  actual 
re  ults  depend  on  the  effectiveness  of  the  controls  un 
operations  as  indicated,  cn  Figure  45.  When  multiple  paranwterc 
are  involved,  operational  control  of  these  parameters 
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usually  resides  with  more  than  one  non- structural  system. 

The  Interface  problems  resulting  from  this  situation  need 
to  be  explored  further. 

e.  It  appears  that  more  explicit  control  of  the  strength  operations 
affecting  the  structural  environment  would  improve  the  structural 
design  situation.  It  is  possible  that  a  PERT-type  operation 

to  ensure  that  the  various  decisions  shown  on  Figures  40  through 
48  are  made  at  the  proper  organizational  level  and  at  the 
proper  time  might  result  in  more  reliable  structural  systems 
for  less  weight  and  cost.  The  problems  associated  with 
establishing  such  a  procedurs  should  be  explored  further. 

f.  The  computer  program  for  calculating  structural  reliability, 
as  presented  in  Volume  III,  starts  with  a  factor  of  safety 
and  prints  out  the  resulting  S.R.  To  determine  the  TFS 
required  for  a  given  S.R.,  as  in  the  curves  of  Figure  12,  it 
is  necessary  to  iterate  for  several  trial  solutions  to  obtain 
the  desired  results.  It  would  be  a  useful  expansion  of  the 
program  if  the  option  could  be  added  so  the  program  would 
automatically  perform  the  iteration.  Then,  a  desired  S.R. 
could  be  input  and  the  TFS  required  for  that  S.R.  would  be 
calculated  in  a  single  operation. 

go  It  w&»  suggested  in  Section  2.3e  that  it  would  be  desirable  to 
modify  t'na  computer  program  of  Volume  III  to  include  a  loads 
error  function  comparable  to  the  strength  function  discussed 
in  Section  2.3c.  This  would  permit  a  computation  of  the 
conditional  structural  reliability  before  and  after  a  flight 
loads  measurement  program.  On  Figure  43  it  is  noted  that  a 
decision  must  be  made  as  to  the  adequacy  of  the  strength  test 
to  simulate  the  failure  modes  properly.  It  is  believed  that 
the  introduction  of  a  qu&ntitized  value  for  this  simulation 
adequacy  into  the  computer  program  would  make  the  calculated 
structural  reliability  more  nearly  correct.  This  would  make 
provision  for  an  assessment  of  the  type  of  test  in  comparison 
to  previous  test  experience,  of  the  effects  of  scale  models 
rather  than  full-scale  teat  articles,  and  of  other  things  such 
as  time  and  tenperature  effects.  An  error  .function  for  the 
statistics  governing  the  choice  of  limit  and  omega  design 
conditions  could  be  introduced  into  the  computer  program. 

Then,  as  data  on  the  actual  operational  usage  were  obtained 
to  validate  or  raise  questions  about  the  design  conditions  as 
discussed  in  Sections  2.3f  and  2.3g(3).  the  computer  program 
would  automatically  update  the  structural  reliability  values. 

The  conditional  reliabilities  and  the  net  structural  reliability 
could  be  prograramod  for  visual  display  on  a  Cathode  Ray  Tube  (CRT). 
An  easily  interpreted  picture  could  be  generated  of  the  status  of 
the  structure  at  each  stage  in  Its  development  and  as  it  is 
expected  to  be  after  completion  of  all  teste.  This  picture 
would  be  comparable  to  Figur©  116. 
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FIGURE  116.  STRUCTURAL  RELIABILITY  GROWTH 


-  227  - 


h.  The  curves  defining  the  design  and  test  factor  of  safety  euch 
ae  Figures  12  and  24  ax  e  based  on  designing  to  the  same  load 
as  the  structure  will  be  tested  to.  There  is  a  potential 
weight  saving  if  the  requirements  for  design  are  lowered  at  the 
same  time  the  test  value  is  increased.  This  would  result  in 
more  teat  failures  but  the  final  reliability  would  be  maintained . 

This  would  give  the  designer  another  option  if  the  increased 

cost  and  schedule  delay  due  to  the  extra  test  failures  are  acceptable 
in  order  to  gain  some  weight  reduction.  Further  study  of  this 
procedure  i6  reconanended . 

i.  The  philosophy  presented  in  Section  II  is  an  outgrowth  of  the 
oritique  presented  in  Volume  I.  This  critique  discussed  the 
problems  associated  with  the  procedures  advocated  in  14 
individual  documents.  It  is  suggested  that  the  authors  of 
these  documents  bs  solicited  for  comments,  both  on  ths  critique 
of  their  paper  and  on  the  new  procedure  proposed  in  this  report. 
These  consnents  could  be  published  at  a  later  date  ae  an  addendum 
to  this  report.  Such  discussions  should  bs  helpful  in  developing 
a  consensus  of  what  is  ths  best  procedure  for  future  structural 
design  criteria. 

J.  A  study  of  the  controls  and  procedures  that  would  lead  to  being 
right  the  first  time  might  be  very  useful  in  reduoing  net  cost 
and  time  for  developing  a  new  structural  system.  Suoh  a  study 
could  be  aooonpliehed  within  the  framework  of  the  Decision 
Network  presented  on  Figures  40  through  48. 

k.  The  recognition  of  errors,  their  type  and  their  frequency  is 
vital  to  establishing  rational  crtteria.  It  is  suggested  that 
the  data  presented  in  Reference  6  be  updated  to  include  teste 
at  contractors'  plants  plus  those  for  other  agendas  such  as 
NASA  and  U3N.  Ibis  would  provide  data  that  could  Justify  or 
repudiate  the  contention  that  structural  design  is  bsooming 
more  preoise  due  to  the  extensive  use  of  computers.  The 
answers  would  be  reflected  in  revisions  to  Figure  5  which 
serves  as  the  basie  for  the  strength  error  function  programmed 
into  the  routine  presented  in  Volume  III. 

l.  A  study  of  the  weight  minimisation  possible  by  a  rational 
reduction  of  structural  design  orlteria  might  be  very  productive. 

It  appears  that  weight  reductions  of  the  same  order  of  magnitude 
as  those  achieved  from  more  efficient  structural  design  may  be 
possible. 

m.  At  the  presant  time  some  of  the  matrices  used  as  input  data  for 
the  fatigue  reliability  program  (such  as  Tables  IV  and  V  In 
Volume  III)  are  hand  calculated.  The  computer  program  oould 
be  modified  to  do  these  automatically.  Addition  of  a  built-in 
error  function  oooparable  to  the  Figure  5  function  for  the  statio 
program  would  make  the  fatigue  program  easier  to  use.  The  present 
program  requires  a  Judgment  oholos  of  valuta  for  PK  (See  pagee 
100  and  131  of  Volume  III). 
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n.  Section  VI  discusses  some  of  the  difficulties  encountered  in 
determining  the  structural  failure  rats  for  a  particular  fleet 
of  airplanes.  It  is  recommended  that  the  data-gathering 
procedure  be  reviewed  to  see  if  the  results  could  be  provided 
in  a  format  mere  useful  to  structural  reliability  analysis. 

o.  bhether  or  not  the  particular  procedure  presented  in  this 
report  is  adopted,  it  is  recommended  that  an  aggressive 
program  be  established  to  develop  and  implement  structural 
design  criteria  that  will  define  the  structural  performance 
necessary  to  achieve  a  quantitatively  definable  goal. 
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